> ## Documentation Index > Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Members and roles > Invite colleagues, choose who is owner, admin or member, change roles and remove people from your company in Pharus. **Plans:** Every plan, and Free. **Who:** owners and admins invite and manage members; only owners grant or change the owner role. Everyone in a company is an owner, an admin or a member. Members do the day-to-day work on vulnerabilities and incidents. Admins also run the settings, and owners also handle billing and the workspace itself. Pricing follows product families, not seats, so you can bring the whole team at no extra cost. ## Roles | Role | Can do | | - | - | | Member | Uploads SBOMs, sets VEX, records decisions and filings. | | Admin | Everything a member does, plus settings, members, tokens and the on-call rota. | | Owner | Everything an admin does, plus billing, closing the workspace and granting the owner role. | The person who creates a company is its first owner. A company always has at least one owner. Roles are per company: you can be an owner in one company and a member in another. See [Companies](/workspace/companies). ## What each role can do Everyone can open and read every page in the company, settings included. Controls your role can't use are locked or left out. | What you do in Pharus | Owner | Admin | Member | | - | - | - | - | | Subscribe, switch plan, add or remove add-ons and extra product families, manage payment and invoices (**Settings → Billing**) | Yes | No | No | | Close or reopen the workspace (**Settings → Company**) | Yes | No | No | | Grant the owner role, or change or remove an owner | Yes | No | No | | Change company details, the default reporting route and SRP readiness (**Settings → Company**) | Yes | Yes | No | | Invite people, change roles, remove members, cancel invitations (**Settings → Members**) | Yes | Yes | No | | Add, edit, archive and restore product families, and set support periods (**Settings → Product families**) | Yes | Yes | No | | Create and revoke API tokens (**Settings → API tokens**) | Yes | Yes | No | | Edit the on-call rota and overrides, send a test page (**Settings → On-call**) | Yes | Yes | No | | Set up Slack, Teams and webhook alerts (**Settings → Notifications**) | Yes | Yes | No | | Change the disclosure settings and the inbound address (**Settings → Disclosure**) | Yes | Yes | No | | Correct the awareness time on an incident (**Correct awareness**) | Yes | Yes | No | | Close and reopen incidents (**Close incident**, **Reopen incident**) | Yes | Yes | No | | Publish an advisory (**Publish advisory**) | Yes | Yes | No | | Cancel a page to the on-call person (**Cancel page**) | Yes | Yes | No | | Remove a reporter's details from a disclosure report (**Remove reporter details**) | Yes | Yes | No | | Download the workspace export (**Settings → Company → Export workspace data**) | Yes | Yes | No | | Ask for expert help on an incident, and send or revoke the partner's link | Yes | Yes | No | | Sign an edition of the technical file (**Sign an edition**), and delete an attachment permanently | Yes | Yes | No | | Upload and retire SBOMs, set VEX | Yes | Yes | Yes | | Declare an incident, edit it, record that a fix is available | Yes | Yes | Yes | | Record decisions and answer approval requests | Yes | Yes | Yes | | Edit the SRP paste pack and the Norwegian notices, record filings and receipts | Yes | Yes | Yes | | Draft and record notices to users | Yes | Yes | Yes | | Page whoever is on call, acknowledge a page | Yes | Yes | Yes | | Reply to and triage disclosure reports, draft upstream reports | Yes | Yes | Yes | | Draft an advisory and send it for review | Yes | Yes | Yes | | Edit the technical file and its attachments | Yes | Yes | Yes | | Run a drill | Yes | Yes | Yes | | Your own profile, phone number, language and notification choices | Yes | Yes | Yes | | Download your own data, delete your own account | Yes | Yes | Yes | Some features depend on the plan as well as the role. See [Plans](/plans). Owners and admins who sign in with a password must use two-step verification. See [Account security](/workspace/account-security#set-up-two-step-verification). ## Invite a member Select **Invite member**. Type their **Work email** and pick **Member** or **Admin**. To make someone an owner, invite them first and change their role after they join. They get an email with a link that works for 7 days. The invitation shows under **Pending invitations** until they answer. The invitation email is in the company's default language. The person signs in, or creates an account with the invited address, and selects **Accept invitation**. See [Join a company you were invited to](/workspace/sign-up#join-a-company-you-were-invited-to). ### Invitation links and inviting again The link only works from the invitation email: an invitation seen anywhere else, such as in Settings or the audit trail, can't be used to join. If the email is lost, the link has expired, or it doesn't open, invite the same address again. Inviting the same email again replaces the old invitation and sends a new link. To withdraw an invitation, select **Cancel invitation** next to it under **Pending invitations**. ## Change someone's role On **Settings → Members**, pick the new role in the person's **Role** column. The change applies at once and is recorded in the [audit trail](/reports/audit-trail). * Admins can switch people between member and admin. * Only owners can make someone an owner, or change the role of an owner. * The last owner can't be changed: "A company needs at least one owner." ### Hand over ownership Pharus has no separate transfer step. An owner makes the new person an owner, then either owner changes the old owner's role to admin or member. ## Remove a member On **Settings → Members**, select the remove icon (**Remove member**) on the person's row and confirm. They lose access to the company straight away and leave the on-call rota. Their decisions and audit history stay: names on decisions, approvals, filings and the audit trail belong to the company's record. Removing someone doesn't delete their Pharus account or their access to other companies. * You can't remove yourself. Ask another owner or admin, or delete your account (see [Data and deletion](/workspace/data-and-deletion#delete-your-account)). * Only owners can remove an owner, and never the last one. You can invite, change roles and remove members also when the workspace is read-only, for example after the trial ends, so the person who will pay can be invited and made owner. ## Related This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.