Skip to main content
Plans: Every plan, and Free. Who: owners and admins export company data; everyone can download their own data and delete their own account; owners close the workspace.
Your company’s data stays yours. You can download all of it at any time, also when the workspace is read-only. This page covers the exports, deleting an account, closing a workspace, and the dates on which Pharus deletes data by itself.

​
Where your data is stored

Customer data is stored in the EU/EEA: the database and the hosting run in Stockholm, Sweden. The sub-processors, what each one does and where it processes data, are listed on the data processing page. How Pharus handles personal data is in the privacy notice. Every record belongs to exactly one company. See Companies.

​
Export all company data

1

Open Settings → Company

Scroll to Export workspace data.
2

Select Download export

Your browser saves one file, named like pharus-export-<your-slug>-<date>.ndjson.gz. A large workspace can take a few minutes.
Owners and admins can export, also when the workspace is on Free, read-only or closed. Each export is recorded in the audit trail. The file holds the company’s members, product families, SBOMs and their original files, matches, incidents, decisions, filings, on-call, advisories, disclosure reports and the full audit trail. Sign-in credentials and secrets are left out.

​
Read the export

The file is gzip-compressed NDJSON: one JSON object per line.
  • The first line is a header: when the file was made and by whom, which tables it holds, the fields and tables left out and why, and notes on the format.
  • Then one line per row: {"table": "...", "row": { ... }}. Field names are Pharus’s own, and times are ISO 8601 in UTC.
  • The last line is a footer with the number of rows per table. A file without it was cut off: download it again.
Original SBOM files are inside as gzip-compressed base64, and technical file attachments as base64. Tables are read one after another, so a change made during the export can show up in one table and not in another.

​
Export your own data

Anyone can download what Pharus holds about them as a person.
1

Open Settings → Your profile

Scroll to Your data.
2

Select Download my data

The file, named like pharus-my-data-<date>.ndjson.gz, has the same format as the company export.
It holds your account, sign-in sessions, memberships and profile, your on-call weeks, and, in each company you belong to now, what you did there and the messages Pharus sent you. Passwords, sign-in tokens and two-step secrets are left out. The companies’ own records are in their workspace export: ask the company for the rest of what it holds about you.

​
Delete your account

1

Open Settings → Your profile

Under Delete account, select Delete account.
2

Confirm it's you

Enter your password. If you sign in only with Microsoft or Google, type your email address instead, within 10 minutes of signing in. Otherwise Pharus asks you to sign in again first.
3

Select Delete account

Your account is deleted at once, and you’re signed out everywhere. Pharus sends a confirmation to your email.
You leave every company you belong to, and invitations you sent that are still pending are deleted. Your name stays on what you recorded in those companies (decisions, approvals, filings and the audit trail), because those records belong to each company. Ask the company if you want something there changed. You can’t delete your account while you’re the only owner of a workspace that isn’t closed. Make someone else an owner under Settings → Members, or close the workspace, first.
A deleted account can’t be restored. You can sign up again with the same address, as a new account.
Both Download my data and Delete account need you to be a member of a company. If you no longer belong to any, contact Pharus support.

​
Close a workspace

An owner closes a workspace when the company stops using Pharus.
1

Export what you need

Download the workspace export and the signed editions of your technical documentation first. See Keep your technical documentation.
2

Open Settings → Company

Under Close workspace, select Close workspace.
3

Confirm

The dialog says until when everything keeps working and when everything is deleted. Type the company name and select Close workspace.
What follows:
  1. The subscription ends. It is cancelled at the end of the paid period, and monitoring and everything else keep working until then. Without a paid period left, the workspace becomes read-only at once.
  2. The workspace is read-only. Monitoring stops, CI uploads of SBOMs are refused and nothing can be changed. It stops taking vulnerability reports: the disclosure page says reports are no longer taken there, and the security.txt is removed. Published advisories stay up until the workspace is deleted.
  3. Everything is deleted 90 days later. The owners get an email when the workspace is closed, and reminders 30 and 7 days before the deletion date.
Until then an owner can select Reopen workspace under Settings → Company, or in the banner. Reopening takes back the cancellation that closing made. A workspace that would come back on its free trial can’t be reopened while you own another company on an unpaid trial.

​
Automatic deletion

Pharus deletes a workspace and everything in it on a date it tells you in advance.
  • Warnings. The first email goes out 30 days before the deletion date, the last 7 days before. Deletion never comes sooner than 7 days after the last warning. The emails go to the owners; if there are none, to the admins; if there are none either, to the members.
  • Keeping it. For a Free workspace, anyone in it can sign in before the date, which moves the date, or an owner can start a subscription. For a closed workspace, an owner reopens it.
  • What goes. Product families, SBOMs, incidents, decisions, filings, technical documentation, disclosure reports and the audit trail. Members who belong to no other workspace lose their account too. This can’t be undone.

​
What Pharus deletes on its own

Some data has a short life even while the workspace is in use.

​
Remove a reporter’s details

If a security researcher asks you to delete their personal data, an owner or admin opens the report in the disclosure inbox and selects Remove reporter details under Reporter’s personal data, then Remove details. Their name, email address and IP hash are removed from the report, its conversation, the triage log, the audit trail and the email log. What they wrote, and your own notes, stay: check them for anything else that identifies the person. You can’t reply to them from Pharus afterwards, and new emails from them open a new report. This works also when the workspace is read-only, and it can’t be undone.

​
Keep your technical documentation

CRA Art. 13(13) asks manufacturers to keep the technical documentation and the EU declaration of conformity for at least 10 years after each product is placed on the market, or for its support period if that is longer. Pharus can’t keep them for you after the workspace is deleted. Download the signed editions before you close a workspace or let it lapse: each edition downloads as a ZIP with its attachments and the SBOM originals. The deletion emails also link the latest signed edition of each product family. See Technical file.

Billing

Technical file

Disclosure inbox

Audit trail