> ## Documentation Index > Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Data and deletion > Where Pharus stores your data, how to export it, delete your account or close a workspace, and when Pharus deletes data by itself. **Plans:** Every plan, and Free. **Who:** owners and admins export company data; everyone can download their own data and delete their own account; owners close the workspace. Your company's data stays yours. You can download all of it at any time, also when the workspace is read-only. This page covers the exports, deleting an account, closing a workspace, and the dates on which Pharus deletes data by itself. ## Where your data is stored Customer data is stored in the EU/EEA: the database and the hosting run in Stockholm, Sweden. The sub-processors, what each one does and where it processes data, are listed on the [data processing page](https://www.pharussecurity.com/en/data-processing). How Pharus handles personal data is in the [privacy notice](https://www.pharussecurity.com/en/privacy). Every record belongs to exactly one company. See [Companies](/workspace/companies). ## Export all company data Scroll to **Export workspace data**. Your browser saves one file, named like `pharus-export--.ndjson.gz`. A large workspace can take a few minutes. Owners and admins can export, also when the workspace is on Free, read-only or closed. Each export is recorded in the [audit trail](/reports/audit-trail). The file holds the company's members, product families, SBOMs and their original files, matches, incidents, decisions, filings, on-call, advisories, disclosure reports and the full audit trail. Sign-in credentials and secrets are left out. ### Read the export The file is gzip-compressed NDJSON: one JSON object per line. * **The first line** is a header: when the file was made and by whom, which tables it holds, the fields and tables left out and why, and notes on the format. * **Then one line per row**: `{"table": "...", "row": { ... }}`. Field names are Pharus's own, and times are ISO 8601 in UTC. * **The last line** is a footer with the number of rows per table. A file without it was cut off: download it again. Original SBOM files are inside as gzip-compressed base64, and technical file attachments as base64. Tables are read one after another, so a change made during the export can show up in one table and not in another. ```bash theme={null} # The header gunzip -c pharus-export-nordlys-2026-10-14.ndjson.gz | head -n 1 | jq . # Rows per table gunzip -c pharus-export-nordlys-2026-10-14.ndjson.gz | jq -r '.table // empty' | sort | uniq -c # The footer: check that the file is complete gunzip -c pharus-export-nordlys-2026-10-14.ndjson.gz | tail -n 1 | jq . ``` ## Export your own data Anyone can download what Pharus holds about them as a person. Scroll to **Your data**. The file, named like `pharus-my-data-.ndjson.gz`, has the same format as the company export. It holds your account, sign-in sessions, memberships and profile, your on-call weeks, and, in each company you belong to now, what you did there and the messages Pharus sent you. Passwords, sign-in tokens and two-step secrets are left out. The companies' own records are in their workspace export: ask the company for the rest of what it holds about you. ## Delete your account Under **Delete account**, select **Delete account**. Enter your password. If you sign in only with Microsoft or Google, type your email address instead, within 10 minutes of signing in. Otherwise Pharus asks you to sign in again first. Your account is deleted at once, and you're signed out everywhere. Pharus sends a confirmation to your email. You leave every company you belong to, and invitations you sent that are still pending are deleted. Your name stays on what you recorded in those companies (decisions, approvals, filings and the audit trail), because those records belong to each company. Ask the company if you want something there changed. You can't delete your account while you're the only owner of a workspace that isn't closed. Make someone else an owner under **Settings → Members**, or close the workspace, first. A deleted account can't be restored. You can sign up again with the same address, as a new account. Both **Download my data** and **Delete account** need you to be a member of a company. If you no longer belong to any, contact [Pharus support](https://www.pharussecurity.com/en/contact). ## Close a workspace An owner closes a workspace when the company stops using Pharus. Download the workspace export and the signed editions of your technical documentation first. See [Keep your technical documentation](#keep-your-technical-documentation). Under **Close workspace**, select **Close workspace**. The dialog says until when everything keeps working and when everything is deleted. Type the company name and select **Close workspace**. What follows: 1. **The subscription ends.** It is cancelled at the end of the paid period, and monitoring and everything else keep working until then. Without a paid period left, the workspace becomes read-only at once. 2. **The workspace is read-only.** Monitoring stops, CI uploads of SBOMs are refused and nothing can be changed. It stops taking vulnerability reports: the disclosure page says reports are no longer taken there, and the security.txt is removed. Published advisories stay up until the workspace is deleted. 3. **Everything is deleted 90 days later.** The owners get an email when the workspace is closed, and reminders 30 and 7 days before the deletion date. Until then an owner can select **Reopen workspace** under **Settings → Company**, or in the banner. Reopening takes back the cancellation that closing made. A workspace that would come back on its free trial can't be reopened while you own another company on an unpaid trial. ## Automatic deletion Pharus deletes a workspace and everything in it on a date it tells you in advance. | Workspace | Deleted | | - | - | | Closed by an owner | 90 days after its access ended: the day it was closed, or the end of its last paid period | | On Free (the trial or the subscription ended unpaid) | 12 months after the later of the day it moved to Free and the last time anyone in it used it | | On its trial, or paid for | Never | * **Warnings.** The first email goes out 30 days before the deletion date, the last 7 days before. Deletion never comes sooner than 7 days after the last warning. The emails go to the owners; if there are none, to the admins; if there are none either, to the members. * **Keeping it.** For a Free workspace, anyone in it can sign in before the date, which moves the date, or an owner can start a subscription. For a closed workspace, an owner reopens it. * **What goes.** Product families, SBOMs, incidents, decisions, filings, technical documentation, disclosure reports and the audit trail. Members who belong to no other workspace lose their account too. This can't be undone. ## What Pharus deletes on its own Some data has a short life even while the workspace is in use. | Data | Deleted | | - | - | | The hash of a reporter's IP address, kept to limit reports per network | After 1 day | | Codes for verifying a phone number | 1 day after they expire | | The content of emails and text messages Pharus sent | After 30 days. The record that a message went out, and to whom, stays with the workspace | | Invitations | 30 days after they were accepted, declined, cancelled or expired | | Email confirmation and password-reset links | When they expire | ## Remove a reporter's details If a security researcher asks you to delete their personal data, an owner or admin opens the report in the [disclosure inbox](/disclosure/inbox) and selects **Remove reporter details** under **Reporter's personal data**, then **Remove details**. Their name, email address and IP hash are removed from the report, its conversation, the triage log, the audit trail and the email log. What they wrote, and your own notes, stay: check them for anything else that identifies the person. You can't reply to them from Pharus afterwards, and new emails from them open a new report. This works also when the workspace is read-only, and it can't be undone. ## Keep your technical documentation CRA Art. 13(13) asks manufacturers to keep the technical documentation and the EU declaration of conformity for at least 10 years after each product is placed on the market, or for its support period if that is longer. Pharus can't keep them for you after the workspace is deleted. Download the signed editions before you close a workspace or let it lapse: each edition downloads as a ZIP with its attachments and the SBOM originals. The deletion emails also link the latest signed edition of each product family. See [Technical file](/reports/technical-file). ## Related This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.