IT Service Management
iTop
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Combodo SAS · combodo.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
iTop at a glance
- Vendor
- Combodo SAS
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention France source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates iTop 3/5, the mean of 6 judges. iTop is an open-source IT service management and CMDB platform from Combodo SAS in Échirolles, France, offered as SaaS or on-premise. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
iTop is an open-source IT service management and CMDB platform from Combodo SAS in Échirolles, France, offered as SaaS or on-premise. Change and problem management scores highest at 7, documenting normal, routine and emergency change types, CAB approval from a calendar, and impact analysis reading infrastructure, customer services and contracts from the CMDB. Sovereignty also scored 7: SaaS hosted in France on OVH infrastructure carrying ISO 27001 and HDS, encrypted backups in a second European datacentre, and a privacy policy stating no data is transferred outside the European Union. Pricing transparency is the weakness at 3 — a free Community edition covers up to 10 agents, but the subscription tiers Community, Atelier and Forge and their Bronze-to-Gold service levels are named without figures, so no annual cost can be computed from the public pages. Service desk, assets and CMDB, and deployment and integration sit at 6. The only spread is the self-service portal, at 4 to 5: higher scores credit the integrated catalogue and customisable forms, lower ones find no public information on announcements, satisfaction surveys or portal languages.
Speaks for it
- Change and problem management scored 7, with normal, routine and emergency change types, CAB approval and impact analysis reading infrastructure, customer services and contracts from the CMDB
- Sovereignty scored 7, with the SaaS hosted in France on OVH (ISO 27001 and HDS), encrypted backups in a second European datacentre, and a privacy policy stating that no data is transferred outside the European Union
- The Community edition is free for up to 10 agents, and the free SaaS version is described as fully complete
- SaaS and on-premise editions both exist, with published open-source code, a REST API, webhooks, compatibility with Teams, Slack and Power Automate, and a 99.3% availability commitment for SaaS
- Every interaction is kept on record, and the incident screen lists changes from the last 72 hours
Held against it
- Pricing transparency scored 3, with the Community, Atelier and Forge tiers and Bronze-to-Gold service levels named without figures, so no annual cost can be computed from the public pages
- The self-service portal scored 4 to 5, with no public information on announcements, satisfaction surveys or portal languages
- No public information names which discovery platforms or connectors such as Intune, SCCM or JAMF are supported
- No public information on a published data processing agreement or a full list of subprocessors with locations
- No public information on time tracking per ticket, major-incident handling or a mobile app for agents
Best for
- You need documented ITIL change management with CAB approval and CMDB-based impact analysis, scored 7 — the top score alongside sovereignty
- You want French SaaS hosting or an on-premise open-source edition you run yourself, with the privacy policy stating that no data is transferred outside the European Union
- You can start on the free Community edition for up to 10 agents before deciding on paid tiers
- You need audit-grade traceability, since every interaction is recorded and configuration items carry their change lists
Avoid if
- You need a public price list to compute an annual cost before contacting sales — pricing transparency scored 3
- You require certification under NIS2 or SecNumCloud — the vendor states it is not eligible for either
- Your self-service strategy depends on announcements, satisfaction surveys or multiple portal languages — the self-service portal scored 4 to 5
The scores
| Criterion | Panel median |
|---|---|
| Service desk, incidents & requests | 3 of 5 |
| Change, problem & release management | 3.5 of 5 |
| Assets, CMDB & discovery | 3 of 5 |
| Self-service portal & service catalog | 2 of 5 |
| Deployment, integrations & multi-client operation | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Service desk, incidents & requests
Show reasoningHide reasoning
How this is scored
How tickets come in and get resolved: intake by email, portal, chat, phone and Microsoft Teams or Slack, incidents and service requests told apart, categories, priorities and an impact-urgency matrix, assignment rules and queues, SLAs with escalation and business hours, major incidents, templates and canned responses, a knowledge base for agents, automations and workflows, time tracking on tickets, and reports and dashboards on volume, resolution time and SLA compliance.
0 — Not a ticketing or service desk product; requests cannot be recorded and worked in it.
3 — Tickets from email and a web form with status, priority and assignment; SLAs, automation and reporting are basic or not described.
5 — Multi-channel intake (email, portal, chat or Teams), incidents and service requests told apart, assignment rules and queues, SLAs with escalation and business hours, an agent knowledge base, rule-based automations, and standard reports on volume, resolution time and SLA compliance.
8 — A visual workflow builder for any ticket type, major incident handling with communication to affected users, SLAs per service, customer and contract, skills- or load-based routing, time tracking on tickets, AI suggestions or classification with what they do stated, custom dashboards and scheduled reports, and a mobile app for agents.
10 — A service desk an organisation of thousands runs on: every workflow, form and SLA configurable without code and versioned, omnichannel intake with one history per requester, AI features documented with their data use and limits, operational level agreements and underpinning contracts tracked, and every report reproducible from an exportable ticket history.
The Service Desk Lead
Email-to-ticket, a user-friendly web portal and automated ticket assignment and dispatch are documented, together with SLA monitoring and escalation, availability windows and holiday calendars, and automated reports on ticket volumes, average resolution time and SLA compliance — the backbone my team needs on a Monday morning. Configurable dashboards, predefined replies and low-code workflow customisation are also documented; we found no public information on major-incident handling with communication to affected users, time tracking on tickets, or a mobile app for agents. 2 8 13
The MSP Owner
Tickets arrive by mail, portal and connected chat tools, requests and incidents run as separate processes with impact-based priorities, automated dispatch, SLA monitoring with escalation, predefined replies and a knowledge base, and reporting covers ticket volumes, SLA compliance and average resolution time on configurable dashboards. We found no public information on time tracking on tickets, major-incident communication or a mobile app for agents, which holds it below the top tier. 2 8 13 14
The Change & Configuration Manager
Intake is documented through mail-to-ticket and a user portal, request and incident management run as separate processes with impact-based prioritization, automated assignment and dispatch, SLA monitoring with escalation and availability windows, knowledge base integration, and reporting on ticket volumes, SLA compliance and average resolution time. Configurable dashboards and predefined replies nudge it above the baseline, but I found no public information on major incident communication to affected users, time tracking on tickets or a mobile app for agents, and the platform is described as AI-ready rather than shipping documented AI assistance. 2 8 13
The Municipal IT Lead
Requests come in through mail-to-ticket and a user portal, incidents and requests are managed as separate processes, and SLA monitoring with escalation, availability windows and holiday calendars, automated ticket assignment and dispatch, predefined replies and exportable reports on ticket volume, SLA compliance and average resolution time are all documented. That covers the working core for a 900-staff district, though we found no public information on time tracking per ticket, major-incident handling or a mobile app for agents. 2 8 13
The Solo IT Admin
Tickets come in via mail-to-ticket, a web portal and documented compatibility with Teams, Slack and Power Automate, with requests and incidents as separate processes, impact-based prioritisation, SLA monitoring with escalation and holiday calendars, automated assignment and dispatch, predefined replies, and reports on ticket volume, resolution time and SLA compliance. Workflow customisation and configurable dashboards are documented, but I found no public information on time tracking per ticket, major-incident handling with communication to affected users, or an agent mobile app. 2 8 11 13 14
The Skeptic
Intake by web portal and mail-to-ticket, impact-based prioritization, automated assignment and dispatch, SLA monitoring with escalation plus availability windows and holiday calendars, knowledge base integration, predefined replies and configurable dashboards, with automated reports naming tickets processed, SLA compliance and average resolution time — a real desk, and the low-code Designer with workflow customization pushes it past the basics. I found no public information on major-incident handling, agent time tracking, a mobile app, or any AI feature beyond an announced platform readiness. 2 8 13
Change, problem & release management
Show reasoningHide reasoning
How this is scored
The ITIL processes behind the ticket: problem records linked to incidents with root cause and known errors, change requests with standard, normal and emergency types, risk and impact assessment, approvals and a change advisory board, a change calendar with blackout periods, release and deployment records, links between changes, problems, incidents and configuration items, process certifications (PinkVERIFY, PeopleCert/AXELOS) named with their scope, and audit trails that a regulated buyer can show an auditor.
0 — No change or problem management of any kind; only tickets.
3 — A change or problem ticket type with a status and an approval step; change types, risk, calendar and links to incidents are basic or not described.
5 — Problem records linked to incidents with root cause and known errors, change requests with standard, normal and emergency types, multi-step approvals, a change calendar, changes linked to incidents and configuration items, and an audit trail of who approved what.
8 — Risk and impact assessment that reads affected services from the CMDB, a CAB workflow with agenda and decisions recorded, blackout periods and collision detection on the change calendar, release management with deployment tasks, change templates for standard changes, and an ITIL process certification named with the processes it covers.
10 — Change and problem management a regulated organisation can be audited on: every process configurable and versioned, change success and failure rates reported, a full trail from incident through problem and change to release exportable, the mapping to ISO/IEC 20000, ITIL 4 or DORA requirements documented, and certifications published with their scope and date.
The Service Desk Lead
Normal, routine and emergency changes with a CAB approving from the calendar, impact analysis that reads the CMDB down to customer services and contracts, changes shown on the incident screen for the last 72 hours, and recurring routine changes generated automatically are all documented, alongside fully documented problems and a software development and release management module. History and traceability of every interaction is stated; we found no public information on blackout periods or collision detection on the change calendar, and the claim of ITIL-certified processes is published without a named certifier or scope. 1 2 8 9
The MSP Owner
The ITIL version separates normal, routine and emergency changes, runs CAB approvals off a calendar, feeds impact analysis from the CMDB down to customer services and contracts, and shows the last 72 hours of changes on incident and CI screens, with recurring routine changes generated automatically and a record kept of every interaction. The homepage claims ITIL-certified processes without naming a certifier or its scope, and we found no public information on blackout periods or collision detection. 9 2 1 8
The Change & Configuration Manager
This is what I would put in front of an auditor: normal, routine and emergency change types, a CAB approving from impact analysis and a calendar, and that impact analysis reading affected infrastructure, customer services and contracts straight out of the CMDB. The incident screen lists changes from the last 72 hours and each configuration item carries its change list, problems are fully documented with recurring-incident analysis, recurring routine changes with predefined tasks can be generated automatically, release management is a named module, and a history of every interaction is kept. The captured pages do not describe calendar blackout periods or collision detection, and the ITIL certification claim comes without a named scope, so I hold it just under the higher marks. 9 2 14 1
The Municipal IT Lead
Change management is documented in ITIL terms with normal, routine and emergency types, a change calendar, CAB approval via a kanban board, and impact analysis that reads the CMDB to foresee effects on infrastructure, customer services and contracts; changes appear on the incident screen for the last 72 hours and as a tab on the configuration item, and problems are fully documented with problem counts per equipment in the automated reports. We found no public information on blackout periods or calendar collision detection, and the claim of ITIL-certified processes is made without naming the processes covered. 9 2 8 1
The Solo IT Admin
Normal, routine and emergency change types, a CAB approving from the calendar and a kanban board, predefined tasks triggered automatically, recurring routine changes generated on schedule, and changes linked to incidents and configuration items — with the impact analysis reading affected services, contracts and infrastructure straight from the CMDB. Release management is a named module and every interaction is kept as an audit trail; I found no public information on blackout periods or calendar collision detection, and the "ITIL-certified processes" claim comes without the certifier or scope behind it. 1 2 4 8 9
The Skeptic
The change documentation is unusually concrete: three ITIL change types, impact analysis read from the CMDB across infrastructure, customer services and contracts, CAB approval using that analysis and the calendar, incident screens showing changes from the last 72 hours and CI screens listing their changes, auto-generated routine changes, predefined tasks and a record of every interaction. Documented problems and a software development and release management module are also named. No blackout periods or calendar collision handling are described, and the homepage's "ITIL-certified processes" names no certifier or scope — I have seen that phrase decorate a status field before. 2 8 9
Assets, CMDB & discovery
Show reasoningHide reasoning
How this is scored
What the product knows about the things tickets are about: an asset inventory of hardware, software and licences, a CMDB with configuration item types, attributes and relationships, a service map or dependency view, agent-based or agentless discovery, imports and synchronisation from Active Directory, Entra ID, Intune, SCCM, JAMF or a discovery tool, software licence compliance, contracts, warranties and the asset life cycle, and assets linked to users, tickets and changes.
0 — No asset or configuration data at all; tickets cannot be linked to devices or services.
3 — A list of assets with basic fields that can be linked to a ticket; relationships, discovery and licences are basic or not described.
5 — An asset inventory of hardware and software, a CMDB with configurable CI types and relationships, network discovery or an inventory agent, an import or sync from Active Directory or Entra ID, contracts and warranties per asset, and assets linked to users, tickets and changes.
8 — A visual service and dependency map used for impact analysis, discovery documented for named platforms (Windows, macOS, Linux, network devices, cloud accounts), connectors to named sources (Intune, SCCM, JAMF, VMware, AWS, Azure), software licence compliance and metering, the full asset life cycle from purchase to disposal, and data quality rules for the CMDB.
10 — A CMDB an organisation can trust for audits and outages: a documented data model with reconciliation of several sources, CI history and change tracking, service models from business service to infrastructure, licence optimisation for named vendors, and every CI and relationship exportable and reachable by API.
The Service Desk Lead
A configurable CMDB with a data synchronisation engine, automated impact analysis, audit and integrity checks and licence and warranty management is documented, with configuration items linked to tickets and changes and training covering syncing and pooling external data and defining audit rules. We found no public information naming discovery platforms or connectors such as Intune, SCCM or JAMF, so I cannot judge how full the inventory keeps itself. 2 9 10 11
The MSP Owner
A customizable data model with audit and integrity checks, licence and warranty management, contract management, and a data synchronization engine with collectors for syncing and pooling external data; automated impact analysis runs from CIs through to customer services and contracts, and the latest version adds containers, data flows and hardware end-of-life tracking. We found no public information on named discovery platforms or connectors such as Intune, SCCM or JAMF, or on licence metering. 2 11 9 10
The Change & Configuration Manager
The CMDB is the centre of the product: a customizable data model, a data synchronization engine with collectors, automated impact analysis, audit and integrity checks, license and warranty management, and newer support for containers, data flows and hardware and operating system end-of-life tracking. Configuration items link to incidents and changes, and the impact analysis reaches customer services and contracts. We found no public information on discovery or connectors for named platforms such as Active Directory, Intune or SCCM, nor an explicitly visual dependency map, which keeps this below the higher anchors. 2 9 10 11
The Municipal IT Lead
The CMDB is the centre of the product: a customizable data model, licence and warranty management, audit and integrity checks, a data synchronisation engine with collectors, automated creation of server components, and new support for containers, data flows and hardware and operating-system end-of-life, with configuration items linked to tickets and changes through impact analysis. We found no public information on discovery or connectors for named platforms such as Intune, SCCM or JAMF, or on a visual service map, so it stands above the middle but well short of the top band. 2 8 11 9
The Solo IT Admin
A customizable data model with a data synchronisation engine and collectors, automated impact analysis reachable directly from a configuration item, audit and integrity checks, and licence and warranty management; configuration items carry their changes on screen and tickets auto-fill with user, hardware and software details. I found no public information naming which platforms discovery covers or which directory sources it syncs from — exactly the bit that would let me bin the spreadsheet nobody trusts. 2 8 9 11
The Skeptic
This is a CMDB, not a device list: a customizable datamodel, a data synchronization engine, automated impact analysis, audit and integrity checks, licence and warranty management, and in the current release containers, data flows and end-of-life tracking for hardware and operating systems. Discovery is named only as "collectors" with no platforms stated, and I found no public information on connectors to named sources such as Intune, SCCM or JAMF, or on licence metering. 2 10 11
Self-service portal & service catalog
Show reasoningHide reasoning
How this is scored
What employees or clients see: a self-service portal with the service catalog, request forms with fields and approvals per service, ticket status and history for the requester, a searchable knowledge base for end users, announcements and outage notices, a virtual agent or chatbot, password reset or other automated fulfilment, branding and languages, single sign-on for the portal, access from Teams or a mobile app, and satisfaction surveys.
0 — No portal or end-user access of any kind; requests can only be emailed or phoned in.
3 — A web portal where users open tickets and see their status; a catalog, knowledge base and approvals are basic or not described.
5 — A branded portal with a service catalog, request forms with approval steps, an end-user knowledge base with search, ticket status and history, announcements, single sign-on, several languages, and satisfaction surveys after resolution.
8 — A service catalog with conditional forms, costs and delivery times per item, automated fulfilment for named requests (password reset, software install, onboarding), a virtual agent in the portal and in Teams or Slack, deflection measured, portals per client or department, and accessibility (WCAG) stated.
10 — A portal that runs as the front door of the organisation: catalog, forms and fulfilment built without code and reused across IT, HR and facilities, the virtual agent documented with its sources and data use, deflection and satisfaction reported per service, and accessibility conformance published with its level.
The Service Desk Lead
A natively integrated user portal with a service catalogue, ticket approval automation, knowledge base integration and single sign-on is documented, and simple requests such as a lost password can be processed automatically — the deflection I want for the Monday printer and VPN tickets. Portal forms and building blocks are customisable per the training material; we found no public information on announcements, satisfaction surveys, portal languages, or measured deflection. 2 8 11 12
The MSP Owner
A native customer portal is integrated in the product with a service catalog and its own dashboard, configurable forms and blocks, approval automation, secure data access per client and single sign-on, and simple requests such as a lost password can be processed automatically. We found no public information on branding, announcements, satisfaction surveys, an end-user knowledge base search or a virtual agent, and multi-customer operation is claimed without stating a portal per client. 2 11 12 8
The Change & Configuration Manager
A native user portal with an integrated service catalog, customizable forms and portal building blocks, automated approval processing and automated handling of simple requests such as password loss is described, with single sign-on available. We found no public information on an end-user knowledge base with search, announcements or outage notices, satisfaction surveys, portal languages or accessibility, so the evidence sits between the basic and the middle level. 2 11 12 8
The Municipal IT Lead
A native user portal, directly integrated into the product, carries a service catalogue with a dedicated dashboard, configurable forms and building blocks, approval automation on tickets, knowledge base integration, single sign-on, and automated handling of simple requests including password loss. We found no public information on announcements and outage notices, satisfaction surveys, portal languages or accessibility, so for our teachers and clerks this reaches the middle level rather than higher. 2 11 12 8
The Solo IT Admin
An end-user portal is integrated into the product and is customisable (forms, blocks, secure access, smoother UX), with a fully integrated service catalogue that now has its own dashboard, ticket approval automation, single sign-on, and automated processing of simple requests such as a lost password or a purchase. I found no public information on announcements, satisfaction surveys or available portal languages. 2 8 11 12
The Skeptic
A native user portal exists and the service catalog is integrated with the CMDB, with approval automation, customizable forms and building blocks (there is a training course devoted to it), and automated handling of simple requests including password loss. I found no public information on announcements, satisfaction surveys, knowledge base search for end users, portal languages, or a virtual agent — the AI story is a platform being "AI-ready", not a chatbot on show. 2 8 11 12
Deployment, integrations & multi-client operation
Show reasoningHide reasoning
How this is scored
How the product is run and connected: a cloud edition and an on-premise or open-source edition with feature parity stated, system requirements and update cadence, a documented REST API and webhooks, integrations with Microsoft 365, Teams, Entra ID, Slack, monitoring tools, RMM and remote support tools, single sign-on (SAML, OIDC) and SCIM, roles and permissions, multi-client or multi-tenant operation with separated data for MSPs, time and contract billing for MSPs, a migration path from other tools, and a public status page.
0 — No documented way to run, connect or administer the product.
3 — Runs as one edition with user roles and an email connection; the API, integrations and other editions are basic or not described.
5 — A documented REST API, integrations with Microsoft 365, Teams and Entra ID or Active Directory, single sign-on, role-based permissions, at least one monitoring or remote support integration, and either an on-premise edition or a stated hosting model with uptime terms.
8 — Cloud and on-premise or open-source editions with feature parity stated, webhooks and an integration marketplace, SCIM provisioning, multi-tenant operation with separated client data for MSPs, time and contract billing, named RMM and monitoring connectors, a documented migration from named tools, and a public status page with uptime history.
10 — Operation at scale and on the customer's terms: open-source code under a named licence or a self-hosted edition with full parity, configuration as code or a staging-to-production transport documented, an API covering every object, high availability and disaster recovery documented, and SLA and support terms published.
The Service Desk Lead
SaaS with a stated 99.3 percent availability commitment and an on-premise edition are both public, with an open-source codebase, a documented REST API, webhooks, compatibility with Teams, Slack and Power Automate, SSO and MFA, role-based permissions and multi-customer capabilities on dedicated instances. We found no public information on SCIM provisioning, a migration path from named tools, or a public status page with uptime history. 2 3 5 14
The MSP Owner
Both a SaaS and an on-premise edition exist, the code is open source, there is a REST API with webhooks, monitoring tools interconnect via API, authentication covers SSO and MFA, permissions are role-based with department silos for data separation and multi-customer operation, and the SaaS carries a 99.3% availability commitment with encrypted backups in a second European datacenter and a disaster recovery plan. No RMM or remote support connector is named, feature parity between editions is not stated, and we found no public information on time and contract billing — the piece my invoices are built on — or a public status page. 2 3 8 13 14
The Change & Configuration Manager
SaaS and on-premise editions both exist, the code is published as open source in a public repository, and integration evidence covers a REST API, webhooks, case exchange, a data synchronization engine, compatibility with Power Automate, Teams, Slack and other tools, and monitoring interconnection via API. SaaS customers get a dedicated virtual machine and instance, a 99,3% availability commitment and a disaster recovery plan across French data centers. We found no public information on SCIM provisioning, a documented migration path from named tools, or a public status page. 3 2 8 13 14 15
The Municipal IT Lead
Both a SaaS edition — hosted in France, with a dedicated virtual machine and instance per customer, a 99.3 percent availability commitment, and a disaster recovery plan — and an on-premise option are documented, alongside a downloadable open-source Community edition and a public code repository; a REST API, webhooks including an OAuth webhook, compatibility with Teams, Slack and Power Automate, SSO, MFA and role-based permissions are listed. We found no public information on SCIM provisioning, a public status page, a documented migration from named tools, or stated feature parity between the editions. 3 2 4 13 14 15
The Solo IT Admin
SaaS and on-premise editions both exist, the SaaS gives a dedicated virtual machine and instance with a disaster recovery plan and a 99.3% availability commitment, and there is a REST API, webhooks, OAuth, SSO and MFA, role-based permissions with department silos, multi-customer operation, and compatibility with Teams, Slack, Power Automate and monitoring tools via API. Feature parity between the editions is not stated, and I found no public information on SCIM provisioning, named remote-management connectors, a documented migration path or a public status page. 2 3 4 13 14
The Skeptic
SaaS and on-premise are both offered, the open-source code is published on GitHub, the REST API and webhooks sit alongside a synchronization engine, monitoring tools interconnect via API, and SSO, MFA, role-based permissions and department silos for data separation are stated. The SaaS side gives each customer a dedicated virtual machine, a disaster recovery plan across French data centers and a 99.3% availability commitment. I found no public information on feature parity between editions, SCIM provisioning, migration from named tools, contract billing, or a public status page. 2 3 13 14 15
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where tickets, attachments, user directories and CMDB data are stored and processed, and who the subprocessors are (hosting, email delivery, AI features, support and payment tools). Independently sourced by the sovereignty pipeline; a service desk holds personal data about every employee and often credentials and network details, so the whole chain counts, not only the database. An on-premise or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email delivery, AI features, support access, payment) run through non-EU providers without a stated safeguard, or the vendor is non-EU with an EU data centre option.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premise edition documented that keeps every record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Service Desk Lead
Combodo is a French SAS registered in Échirolles; the SaaS runs at OVH in a European datacenter with ISO 27001 and HDS stated, encrypted backups in a second European datacenter, a disaster recovery plan on French soil, and the privacy policy states no data is transferred outside the European Union, with a DPO appointed and CNIL named as supervisory authority. Open-source and on-premise editions are documented and a reversibility clause promises data return in a usable format; we found no public information on a published data processing agreement or a list of subprocessors with their locations. 4 5 6 7 13
The MSP Owner
Combodo is a French SAS in Échirolles under French law, SaaS runs on OVH in a European datacenter carrying ISO 27001 and HDS over sovereign French data centers, and the privacy policy states 'no data is transferred outside the European Union'; a DPO is appointed and an on-premise open-source edition exists for running it on our own servers. The pages publish neither a data processing agreement nor a list of subprocessors with their locations, and the vendor states it holds neither NIS2 nor SecNumCloud certification. 4 6 7 13
The Change & Configuration Manager
The contracting entity is a French company in Échirolles, the SaaS product is hosted in France on sovereign data centers subject to French law, on OVH infrastructure certified ISO 27001 and HDS, with encrypted backups in a second European datacenter and a stated policy that no data is transferred outside the European Union. A data protection officer is appointed under GDPR, CNIL is named as the supervisory authority, ANSSI security rules are followed, and a reversibility clause returns my data in a usable format. We found no public information on a complete subprocessor list with locations or a published data processing agreement, which is what I would still need in my files before signing. 13 4 7 6
The Municipal IT Lead
Combodo is a French SAS in Échirolles with a registered SIRET and an appointed Data Protection Officer, the SaaS runs on OVH in a European datacenter carrying ISO 27001 and HDS, backups are encrypted in a second European datacenter, the privacy policy states that no data is transferred outside the European Union, and an on-premise open-source edition exists that we could run on our own servers. We found no public information on a published data processing agreement or a full list of subprocessors with their locations, which is exactly what our data protection officer would demand before sign-off. 4 6 7 13 3
The Solo IT Admin
Combodo is a French SAS in Échirolles, the SaaS runs in France on OVH's ISO 27001 + HDS European datacentres with encrypted backups in a second European datacentre, the privacy policy states that no data is transferred outside the European Union, and on-premise and open-source editions are documented. I found no public information on a published data processing agreement or a full subprocessor list with locations, and the vendor itself states it is not eligible for NIS2 certification or SecNumCloud. 4 5 6 7 13 14
The Skeptic
The chain is French as far as it goes: Combodo SAS in Échirolles, SaaS hosted in France on OVH with encrypted backups in a second European datacenter, a stated commitment that no data is transferred outside the European Union, an appointed Data Protection Officer, CNIL complaint rights, a reversibility clause in a usable format, and an on-premise open-source edition. I found no public information on subprocessors beyond the host — email delivery, support tooling and payment are unlisted — and no published data processing agreement, while the ISO 27001 and HDS marks sit beside the OVH hosting and the vendor itself states it is not eligible for NIS2 or SecNumCloud certification. Solid and honest, but short of the top band on evidence. 4 6 7 13 14
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per agent, technician or analyst and tier, whether requesters and portal users are free, what counts as an asset or node and how it is priced, which modules (CMDB, change, asset discovery, AI, ESM) cost extra, the on-premise licence or subscription and its maintenance, the free or open-source edition and paid support, minimum term, onboarding and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free edition exists, but how cost scales with agents, assets or modules is unclear.
5 — Tiers are public with their price per agent and main inclusions, but at least one commonly needed piece (asset packs, CMDB or discovery, AI features, on-premise licence, onboarding) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (agents, assets, clients), add-ons and asset packs priced, the on-premise licence and maintenance or the open-source support plans priced, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of agents, assets and modules, cloud or on premise, with every add-on, setup, training, support and overage fee and the cancellation and data-return terms published.
The Service Desk Lead
A free iTop Community edition for up to 10 agents and a fully complete free SaaS version are public, and the Community, Atelier and Forge subscription levels are named with their service tiers. We found no public information on per-agent prices, how cost scales with agents or assets, or prices for the optional modules, so I cannot compute our annual cost from these pages. 1 3 13
The MSP Owner
A free Community edition exists for 'Up to 10' agents, with a complete free SaaS version and a free trial, but the subscription page names the tiers — Community, Atelier, Forge — with Bronze to Gold service levels without publishing any prices. I cannot compute what this costs for twenty-two technicians across sixty clients, and that is the number I need before picking up the phone. 1 3 13
The Change & Configuration Manager
The Community edition is free with a stated agent limit of up to 10, and a fully complete free SaaS version and trial are offered, but the paid structure — Community, Atelier and Forge, with feature bundles and Bronze-to-Gold service levels — appears on the subscription pages without any prices. We found no public information on price per agent for the paid tiers, module or asset pricing, minimum term or onboarding costs, so an annual cost cannot be computed from the public pages alone. 1 3 13
The Municipal IT Lead
The Community edition is public at no cost for up to 10 agents, the SaaS free version is described as fully complete with support included in the price, and training formats are published — but the captured subscription page presents the Atelier and Forge tiers, service levels Bronze, Silver and Gold, without any prices. For a public tender I need a price list the procurement office can annex, and no annual cost is computable from the public pages alone. 1 3 13
The Solo IT Admin
The Community edition is free ("A free and functional base… NUMBER OF AGENTS Up to 10 (Recommended)"), the SaaS free version is described as fully complete with support included in the price, and the paid offers are named Community, Atelier and Forge across Standard, Operational and Industrial service levels with Bronze/Silver/Gold service tiers — but I found no public price figures for those paid tiers, so how cost scales with agents, modules or assets is unclear. For a one-man shop that means a sales call rather than a number I can put in next year's budget. 1 3 13
The Skeptic
A free Community edition capped at 10 agents, a free SaaS trial, and a free SaaS version described as fully complete are public, with support included in the price. But the three subscription levels — Community, Atelier, Forge — are presented with no figures at all, and I found no public information on per-agent pricing, what Atelier and Forge cost, or on-premise licensing and maintenance. No buyer can compute an annual cost from these pages. 1 3 13
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about iTop
Is iTop European?
Yes. whats-best.ai classifies iTop as EU-Made.
Where does iTop store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention France as hosting location, per the vendor’s page captured 1 Nov 2026.
Does iTop have a free plan?
Yes. iTop has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to iTop?
As of 2 Nov 2026, the panel rates ManageEngine ServiceDesk Plus (3.5/5), Xurrent ITSM (3/5) and GLPI (3/5) highest among the other 14 IT Service Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is GLPI (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: iTop alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Transfer impact assessment, Open source, Hosting location, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage combodo.com Checked 1 Nov 2026 Details →
- 2 Features page combodo.com Checked 1 Nov 2026 Details →
- 3 Subscription levels page (no prices) combodo.com Checked 1 Nov 2026 Details →
- 4 Security / trust page combodo.com Checked 1 Nov 2026 Details →
- 5 Company page combodo.com Checked 1 Nov 2026 Details →
- 6 Legal notice combodo.com Checked 1 Nov 2026 Details →
- 7 Privacy policy combodo.com Checked 1 Nov 2026 Details →
- 8 Service desk, incidents & requests — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 9 Change, problem & release management — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 10 Assets, CMDB & discovery — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 11 Assets, CMDB & discovery — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 12 Self-service portal & service catalog — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 13 Deployment, integrations & multi-client operation — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 14 Deployment, integrations & multi-client operation — found from sitemap combodo.com Checked 1 Nov 2026 Details →
- 15 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →