# iTop — IT Service Management iTop by Combodo SAS holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-02. Provenance: EU-Made; sovereignty: not determined. - Vendor: Combodo SAS (https://combodo.com/) - Category: [IT Service Management](https://whats-best.ai/software/itsm.md) - Provenance (editorial classification): EU-Made - Canonical page: https://whats-best.ai/software/itsm/itop - Alternatives: https://whats-best.ai/software/itsm/itop/alternatives ([markdown](https://whats-best.ai/software/itsm/itop/alternatives.md)) - Data as of: 2026-11-06 · evaluated 2026-11-02 · oldest source captured 2026-11-01 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Combodo SAS - Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026 - Data hosting: Default not stated; pages mention France [S13] - Free plan: Yes, per the vendor’s own page [S1] ## The panel's verdict iTop is an open-source IT service management and CMDB platform from Combodo SAS in Échirolles, France, offered as SaaS or on-premise. Change and problem management scores highest at 7, documenting normal, routine and emergency change types, CAB approval from a calendar, and impact analysis reading infrastructure, customer services and contracts from the CMDB. Sovereignty also scored 7: SaaS hosted in France on OVH infrastructure carrying ISO 27001 and HDS, encrypted backups in a second European datacentre, and a privacy policy stating no data is transferred outside the European Union. Pricing transparency is the weakness at 3 — a free Community edition covers up to 10 agents, but the subscription tiers Community, Atelier and Forge and their Bronze-to-Gold service levels are named without figures, so no annual cost can be computed from the public pages. Service desk, assets and CMDB, and deployment and integration sit at 6. The only spread is the self-service portal, at 4 to 5: higher scores credit the integrated catalogue and customisable forms, lower ones find no public information on announcements, satisfaction surveys or portal languages. **Speaks for it:** - Change and problem management scored 7, with normal, routine and emergency change types, CAB approval and impact analysis reading infrastructure, customer services and contracts from the CMDB - Sovereignty scored 7, with the SaaS hosted in France on OVH (ISO 27001 and HDS), encrypted backups in a second European datacentre, and a privacy policy stating that no data is transferred outside the European Union - The Community edition is free for up to 10 agents, and the free SaaS version is described as fully complete - SaaS and on-premise editions both exist, with published open-source code, a REST API, webhooks, compatibility with Teams, Slack and Power Automate, and a 99.3% availability commitment for SaaS - Every interaction is kept on record, and the incident screen lists changes from the last 72 hours **Held against it:** - Pricing transparency scored 3, with the Community, Atelier and Forge tiers and Bronze-to-Gold service levels named without figures, so no annual cost can be computed from the public pages - The self-service portal scored 4 to 5, with no public information on announcements, satisfaction surveys or portal languages - No public information names which discovery platforms or connectors such as Intune, SCCM or JAMF are supported - No public information on a published data processing agreement or a full list of subprocessors with locations - No public information on time tracking per ticket, major-incident handling or a mobile app for agents **Best for:** - You need documented ITIL change management with CAB approval and CMDB-based impact analysis, scored 7 — the top score alongside sovereignty - You want French SaaS hosting or an on-premise open-source edition you run yourself, with the privacy policy stating that no data is transferred outside the European Union - You can start on the free Community edition for up to 10 agents before deciding on paid tiers - You need audit-grade traceability, since every interaction is recorded and configuration items carry their change lists **Avoid if:** - You need a public price list to compute an annual cost before contacting sales — pricing transparency scored 3 - You require certification under NIS2 or SecNumCloud — the vendor states it is not eligible for either - Your self-service strategy depends on announcements, satisfaction surveys or multiple portal languages — the self-service portal scored 4 to 5 ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The Service Desk Lead | The MSP Owner | The Change & Configuration Manager | The Municipal IT Lead | The Solo IT Admin | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Service desk, incidents & requests | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | | Change, problem & release management | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Assets, CMDB & discovery | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | | Self-service portal & service catalog | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2/5 | | Deployment, integrations & multi-client operation | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | | European sovereignty | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Pricing transparency | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | | **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | ### The judges - **The Service Desk Lead** (v1.0): Leads a team of eight agents at a machine builder with 1,400 employees across three plants in Germany and one in Poland. Most tickets still arrive by email, and the same printer and VPN questions come in every Monday. Wants incidents and requests told apart, SLAs that escalate on their own, a portal with a catalog people actually use, answers that deflect the Monday tickets, and reports the IT director reads without a spreadsheet. - **The MSP Owner** (v1.0): Owns a managed service provider with twenty-two technicians and sixty client companies, from dental practices to a logistics firm with nine sites. Every client has its own contract, its own SLA and its own devices, and every hour has to end up on an invoice. Wants one desk with client data kept apart, the RMM and remote support tool connected, time and contracts billed, a portal per client, and a price per technician that still works when the team doubles. - **The Change & Configuration Manager** (v1.0): Change and configuration manager at a regional bank that answers to BaFin and, since January 2025, to DORA. Chairs the weekly change advisory board and has to show an auditor who approved which change, which services it touched and which incident it caused. Wants change types with real approvals, risk read from a CMDB that knows how systems depend on each other, problem records tied to incidents, and an audit trail that can be exported. - **The Municipal IT Lead** (v1.0): Runs IT for a district administration with 900 staff, schools included, on servers in the municipal data centre. Follows BSI IT-Grundschutz and buys through public tenders, and the data protection officer will not sign off staff and device data on a US cloud. Wants an on-premise or open-source edition that is documented and maintained, a portal for teachers and clerks, assets linked to tickets, and a contract and price list the procurement office can put into a tender. - **The Solo IT Admin** (v1.0): The whole IT department of a 160-person engineering firm, with a part-time trainee on Thursdays. Requests come in by email, Teams and in the corridor, and the asset list is a spreadsheet nobody trusts. Has no time for an ITIL project: wants email and Teams turned into tickets, a simple portal with answers to the common questions, laptops and licences found automatically, a setup that takes days rather than months, and a price they can read off the website. - **The Skeptic** (v1.0): Has seen "ITIL-certified" on a tool whose change management is a status field, a "CMDB" that is a list of devices without a single relationship, and an "AI agent" that searches the knowledge base. Reads that a product runs on premise and asks whether that edition gets the same features, which of the asset packs are extra, where the tickets and attachments are stored — and how ten years of ticket history would leave. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Anssi: yes · yes [S14] - Anssi security rules: yes · yes · yes [S4] - Audits: yes · yes [S13] - Audits: yes [S14] - GDPR framework: French Law n°78-17 (LIL) · GDPR n°2016/679 [S7] - Nis2 secnumcloud: no · yes · no [S14] - No transfer outside EU: no · no [S7] - Regular audits: yes [S4] - Rights contact email: privacy@combodo.com [S7] - Rights guaranteed: yes · yes · yes · yes · yes · yes [S7] - Rights response time: 1 [S7] - Security audits: yes · yes [S3] - Security features: role-based permissions · SSO delegated authentication · multi-factor authentication · brute force protection · department silos [S2] - Security policy public: yes [S13] - Supervisory authority: CNIL · https://www.cnil.fr/fr/plaintes [S7] - Vulnerability disclosure: yes [S13] - Vulnerability process: yes [S4] **Data** - Cookie retention: 13 · 12 [S7] - Retention contact form: 5 [S7] - Retention job applications: 2 [S7] - Reversibility clause: yes · usable format [S13] **Hosting** - Backup management: yes · yes [S4] - Company address: 5 Rue de l'Octant, 38130 Échirolles [S12] - Dedicated instance: yes [S13] - Drp: yes [S13] - Location: France · yes · yes [S13] - Provider: 504 Lavaca, Suite 1000, Austin, TX 78701, USA [S6] - Provider: WP Engine [S7] - Saas provider: European Datacenter · OVH · ISO 27001 · HDS [S4] **Integrations** - Capabilities: REST API · webhooks · case exchange · data synchronization engine · collectors [S2] - Oauth compatibilities: Power Automate · Teams · Slack · Googlechat · RocketChat [S14] **Legal** - Address: 5 Rue de l'Octant, 38130 Échirolles [S3] - Address: 5 Rue de l'Octant, 38130 Échirolles [S5] - Address: parc sud galaxie batiment atlas, 5 rue de l'octant, 38130 Echirolles, France [S6] - Address: 5 Rue de l'Octant, 38130 Échirolles [S8] - Address: 5 Rue de l'Octant, 38130 Échirolles [S11] - Address: Échirolles · 5 Rue de l'Octant · France [S13] - Capital: 279045 [S6] - Company address: 5 Rue de l'Octant, 38130 Échirolles [S10] - Copyright: © Combodo, 2026. All rights reserved. [S6] - Entity address: Combodo · 5 RUE DE L'OCTANT 38130 ECHIROLLES, FRANCE [S7] - Entity name: Combodo · SAS [S6] - Founded: Grenoble · 2010 · France [S5] - Photo credits: Tatyana Romanova [S6] - Siret: 52258897900024 [S6] - Site creator: Mexiiico [S6] - VAT number: FR84522588979 [S6] - Webmaster: Delphine Coille [S6] **Pricing** - Community plan: iTop Community · 0 · 10 · yes [S1] - Training schedule: monthly [S12] **Product** - Activity monitoring: SLA monitoring · multi-channel notifications · exportable reports · analytics integration · audits and error reports · configurable dashboards [S2] - Activity monitoring: activity monitoring with SLA tracking and analytics [S1] - AI ready: AI-ready ITSM · no [S11] - Article date: OCT 24, 2023 [S8] - Audit trail: yes [S14] - Authentication MFA SSO: SSO (Single Sign-On) · brute-force protection · MFA [S4] - Automated reports indicators: automated reports cross-referencing indicators to detect automation opportunities · number of tickets processed · problems generated per equipment · SLA compliance · average resolution time [S8] - Automation: SLA monitoring and escalation · automated ticket assignment and dispatch · bulk data updates · expiration alerts · automatic object creation [S2] - Automation: automation of repetitive tasks [S1] - Automation examples: automatable tasks: helpdesk responses, ticket creation from infrastructure alerts, ticket dispatch, auto-adding user/hardware/software info, change/update notifications, processing simple requests (purchases, password loss) [S8] - Change cab approval: yes [S9] - Change dashboards: Change tracking dashboard for continuous improvement analysis [S9] - Change documentation: Change procedures documented as attachment, HTML note, or link [S9] - Change impact analysis cmdb: yes [S9] - Change incident recent changes: 72 [S9] - Change invitations: yes [S9] - Change itil types: normal · routine · emergency [S9] - Change kanban approval: yes [S9] - Change predefined tasks: yes [S9] - Change printout signature: yes [S9] - Change recurring generation: yes [S9] - Change roles: change managers · change supervisors · implementation coordinators [S9] - Change simple version: Simple version includes one type of change and a simplified workflow [S9] - Ci enrichment: yes · yes [S11] - Cmdb: customizable datamodel · data synchronization engine · automated impact analysis · audit and integrity checks · license and warranty management · asset management ready [S2] - Cmdb: CMDB [S1] - Cmdb server component automation: automate creation and description of server component in CMDB, plus monitoring and backups [S8] - Community members: 10000 [S5] - Company customers: 3800 [S5] - Containers data flows: yes · yes · yes [S11] - Customization: iTop Designer · datamodel customization · UI customization · user profiles customization · workflows customization · advanced customization through development [S2] - Customization: customization including low-code designer [S1] - Customization support: yes [S9] - Early access: yes [S3] - Editions offers: iTop Community · iTop Atelier · iTop Forge [S8] - Event meetup 2026: 2026-11-26 · iTop Community Meetup 2026 · 10 · The Paris Aquarium [S1] - Extension maintenance: only latest extension version maintained [S14] - Feature modules: Integrated ITIL Process Management · Configurable CMDB · Standard integration · Standard Service Management Features · Advanced Service Management Features · Automation · Industrialized service management · Software Development & Release M… [S3] - Featured capabilities: Service Management, CMDB, Request & Incident management, Problem & Change management, Activity monitoring, Integration, Customization, Security, Project management [S7] - Features: Service Management · CMDB · Request & Incident management · Problem & Change management · Activity monitoring · Integration · Customization · Security · Project management [S5] - Features: Features include user portal, impact analysis, mail to ticket, dashboards [S13] - Footer features: Service Management · CMDB · Request & Incident management · Problem & Change management · Activity monitoring · Integration · Customization · Security · Project management [S8] - Free trial: yes [S13] - Free version completeness: iTop SaaS free version is fully complete, including assets, employees and helpdesk management [S13] - History traceability: yes [S4] - In person format: on your premises · 1.5 [S12] - Integration: integration with external tools [S1] - Internal messaging: yes [S14] - Itil certified: yes [S1] - Itop designer: iTop Designer is a low-code customization tool [S3] - Itop platform: iTop is a flexible and scalable open-source ITSM platform [S5] - Legal grounds: consent · legitimate interests [S7] - Maintenance schedule: not maintained · final STS 3.1 release · Q3 2025 [S14] - Mariadb maxscale partner: MariaDB · MariaDB Maxscale [S4] - MFA: released as security modules · yes [S14] - MFA configuration: yes · yes [S14] - MFA hub availability: no · yes [S14] - MFA methods: mobile_app · email_code [S14] - MFA protocols: Windows Hello · U2F · FIDO2 [S14] - MFA recovery codes: yes [S14] - Monitoring integration API: interconnect monitoring tool to ITSM solution via API for automatic incident alerts [S8] - Native portal: yes [S11] - Oauth webhook: yes [S14] - Offers: iTop Community · iTop Atelier · iTop Forge [S5] - Online format: 3 · 2 · 1 hour & 3 hours [S12] - Open source: France · yes [S1] - Open source: yes [S5] - Open source saas: yes [S13] - Outcome: At the end of the course, you will be able to customize your iTop Portal. [S12] - Prerequisites: basic web application knowledge · completion of the Designer course · knowledge of the iTop datamodel [S12] - Problem change management: ITIL approach to change · change monitoring · documented recovery plans · sub-task management · escalation · documented problems [S2] - Problem change management: problem and change management [S1] - Project release management: software and release management · project management module · calendar view · kanban · gantt diagram [S2] - Project release management: project and release management module [S1] - Readonly access: yes [S11] - Recurring incident automation: analyze recurring incident types and trigger automatic curative actions via dedicated input form [S8] - Regular upgrades: yes [S3] - Release lifecycle: yes · yes [S4] - Release version: iTop 3.3 [S11] - Request incident management: web portal · ticket approval automation · impact-based prioritization · multi-customer capabilities · ticket relationship management · predefined replies · attachments [S2] - Request incident management: request and incident management [S1] - Saas availability: yes · yes [S3] - Saas availability commitment: 99.3 [S4] - Saas availability SLA: 99.3 [S3] - Saas security patching: yes [S4] - Secure internal communication: yes [S4] - Security feature: dedicated security features [S1] - Server deployment automation: automated workflow initializes equipment (OS, network, software) on server connection request [S8] - Service catalogue dashboard: yes [S11] - Service management: service catalog · SLA-driven management · availability windows & holiday calendars · contract management · multi-channel communication · knowledge base integration · third-party support [S2] - Service management: service management with service catalog integrated with CMDB [S1] - Services offered: ITOP SAAS · SUPPORT · CONSULTANCY · TRAINING [S3] **Support** - Channels: Documentation · Open source project · Support client · Download iTop Community · iTop Hub [S5] - Dedicated expert: Dedicated iTop expert for onboarding with iTop SaaS [S3] - Included: Support packs · A rich and complete FAQ · ITSM / CMDB training · Support from the open source community [S13] - Included in price: yes [S3] - Simple to itil switch: yes [S9] - Training languages: French · English [S12] 22 more facts on the canonical page: https://whats-best.ai/software/itsm/itop ## Questions ### Is iTop European? Yes. whats-best.ai classifies iTop as EU-Made. ### Where does iTop store data? The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention France as hosting location, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/15204). ### Does iTop have a free plan? Yes. iTop has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/15158). ### What are the best alternatives to iTop? As of 2 Nov 2026, the panel rates [ManageEngine ServiceDesk Plus (3.5/5)](https://whats-best.ai/software/itsm/manageengine-servicedesk-plus), [Xurrent ITSM (3/5)](https://whats-best.ai/software/itsm/xurrent) and [GLPI (3/5)](https://whats-best.ai/software/itsm/glpi) highest among the other 14 IT Service Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [GLPI](https://whats-best.ai/software/itsm/glpi) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [iTop alternatives](https://whats-best.ai/software/itsm/itop/alternatives). ## What this page leaves out - 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. ## Sources - [S1] Vendor homepage: https://combodo.com/ (checked 2026-11-01) - [S2] Features page: https://combodo.com/features/ (checked 2026-11-01) - [S3] Subscription levels page (no prices): https://combodo.com/offers-services/ (checked 2026-11-01) - [S4] Security / trust page: https://combodo.com/security/ (checked 2026-11-01) - [S5] Company page: https://combodo.com/about-us/ (checked 2026-11-01) - [S6] Legal notice: https://combodo.com/legal-mentions/ (checked 2026-11-01) - [S7] Privacy policy: https://combodo.com/privacy-policy/ (checked 2026-11-01) - [S8] Service desk, incidents & requests — found from sitemap: https://combodo.com/itop/itsm-software-automation-as-a-vector-of-savings/ (checked 2026-11-01) - [S9] Change, problem & release management — found from sitemap: https://combodo.com/itop/managing-change-effectively-with-itop/ (checked 2026-11-01) - [S10] Assets, CMDB & discovery — found from sitemap: https://combodo.com/training/itop-cmdb-training/ (checked 2026-11-01) - [S11] Assets, CMDB & discovery — found from sitemap: https://combodo.com/itop/itop3-3-ai-ready-itsm-cmdb/ (checked 2026-11-01) - [S12] Self-service portal & service catalog — found from sitemap: https://combodo.com/training/itop-portal-configuration-training/ (checked 2026-11-01) - [S13] Deployment, integrations & multi-client operation — found from sitemap: https://combodo.com/itop/cloud-hosting-5-good-reasons-to-trust-the-saas-version-of-itop/ (checked 2026-11-01) - [S14] Deployment, integrations & multi-client operation — found from sitemap: https://combodo.com/itop/security-itop-mfa-webhook-oauth-2025/ (checked 2026-11-01) - [S15] Code repository (open-source licence) — found from the homepage: https://github.com/Combodo/itop (checked 2026-11-01) --- Cite as: whats-best.ai, "iTop — IT Service Management", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/itsm/itop Corrections: https://whats-best.ai/correct/1332?target=page