IT Service Management
Xurrent ITSM
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Xurrent, Inc. · www.xurrent.com
Compare with HaloITSM → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Xurrent ITSM at a glance
- Vendor
- Xurrent, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Xurrent ITSM 3/5, the mean of 6 judges. Xurrent ITSM is a cloud service-management platform whose strongest scoring is the service desk: scores cluster at 7, on multi-channel intake — email, portal, chat, telephony — landing in one request record, with the service instance setting the team and SLA targets. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Xurrent ITSM is a cloud service-management platform whose strongest scoring is the service desk: scores cluster at 7, on multi-channel intake — email, portal, chat, telephony — landing in one request record, with the service instance setting the team and SLA targets. Deployment and integration scores run 6 to 7 on REST, GraphQL, bulk, events, mail and webhook APIs with a change log and deprecation notices, plus MSP licence plans, account trusts and billing into external invoicing tools; persona-weighted totals run 5.8 to 6.8, peaking for managed-service providers. The real split is change and problem, spread 4 to 6: judges crediting the RFC-to-workflow change model, risk assessment and the audit trail scored high, while those weighing problem management — shown only as a capability statement about recurring incidents — scored low. Sovereignty scores sit at 5 to 6: customers choose a processing region including the EEA and the subprocessor list is published, but the contracting entity is Xurrent, Inc. of Austin, Texas, and the list names Google (email hosting) and Slack in the United States. The pricing page publishes tier names but no price figure.
Speaks for it
- Service desk scores cluster at 7, on intake by email, portal, chat and computer telephony feeding one request record whose service instance sets team and SLA targets
- Deployment and integration scores run 6 to 7, with REST, GraphQL, bulk, events, mail and webhook APIs, a change log, deprecation notices, SCIM and just-in-time provisioning
- MSP licence plans, account trusts and billing into external invoicing tools are documented for multi-client operation
- The audit console chronologically records creations, updates and deletions with who and when, readable through an Auditor role
- The virtual agent is documented in depth, covering request-template matching, pre-populated custom fields, degraded-service awareness and saved chats
Held against it
- Change and problem scores spread 4 to 6, with problem management shown only as a capability statement about recurring incidents
- The documented guidance expects external system management tools to maintain technical detail, and we found no public information on discovery connectors such as Intune, SCCM or JAMF
- The contracting entity is Xurrent, Inc. of Austin, Texas, and the published subprocessor list names Google (email hosting) and Slack in the United States
- We found no public information on a change calendar, blackout periods, a change advisory board, or standard, normal and emergency change types
- The pricing page names 'STARTER 10 Platform Users/Month', 'CORPORATE 50 Platform Users/Month' and 'ENTERPRISE 100 Platform Users/Month' with no price figure in any currency
Best for
- You run an MSP or multi-provider operation and need account trusts, MSP licence plans and billable time flowing into external invoicing tools.
- You want one request record behind email, portal, chat and telephony intake, with the service instance deciding the team and the SLA targets.
- Your developers need public REST, GraphQL, bulk, events and webhook APIs with a change log and deprecation notices.
- You must show auditors a chronological record of every creation, update and deletion, including who and when.
Avoid if
- You need documented problem management — root cause, known errors, links to incidents — before committing; the captured pages show only a capability statement about recurring incidents.
- Your data protection officer requires an EU contracting entity or non-US subprocessors for email; the pages name Xurrent, Inc. of Austin, Texas, and the published subprocessor list shows Google and Slack in the United States.
- You expect built-in discovery from named platforms such as Intune, SCCM or JAMF; the documented guidance points to external system management tools for maintaining technical detail.
- You must run the service in your own data centre; the documented offering is a cloud service with customer data stored in a chosen processing region.
The scores
| Criterion | Panel median |
|---|---|
| Service desk, incidents & requests | 3.5 of 5 |
| Change, problem & release management | 2.5 of 5 |
| Assets, CMDB & discovery | 3 of 5 |
| Self-service portal & service catalog | 3 of 5 |
| Deployment, integrations & multi-client operation | 3.5 of 5 |
| European sovereignty | 3 of 5 |
Service desk, incidents & requests
Show reasoningHide reasoning
How this is scored
How tickets come in and get resolved: intake by email, portal, chat, phone and Microsoft Teams or Slack, incidents and service requests told apart, categories, priorities and an impact-urgency matrix, assignment rules and queues, SLAs with escalation and business hours, major incidents, templates and canned responses, a knowledge base for agents, automations and workflows, time tracking on tickets, and reports and dashboards on volume, resolution time and SLA compliance.
0 — Not a ticketing or service desk product; requests cannot be recorded and worked in it.
3 — Tickets from email and a web form with status, priority and assignment; SLAs, automation and reporting are basic or not described.
5 — Multi-channel intake (email, portal, chat or Teams), incidents and service requests told apart, assignment rules and queues, SLAs with escalation and business hours, an agent knowledge base, rule-based automations, and standard reports on volume, resolution time and SLA compliance.
8 — A visual workflow builder for any ticket type, major incident handling with communication to affected users, SLAs per service, customer and contract, skills- or load-based routing, time tracking on tickets, AI suggestions or classification with what they do stated, custom dashboards and scheduled reports, and a mobile app for agents.
10 — A service desk an organisation of thousands runs on: every workflow, form and SLA configurable without code and versioned, omnichannel intake with one history per requester, AI features documented with their data use and limits, operational level agreements and underpinning contracts tracked, and every report reproducible from an exportable ticket history.
The Service Desk Lead
Email intake, the portal, chat running alongside the virtual agent and even phone work via computer telephony integration are all documented, and incidents sit beside changes and other requests as categories with the service instance deciding the team and the SLA targets — exactly the shape my Monday-morning queue needs. The AI work is unusually well described: auto-classification routing inbound mail, a triage agent that links configuration items and gates incomplete tickets, and a closure agent for verification notes. I stop short of the top band because SLA escalation and business hours, custom dashboards, and a visual workflow builder are not described on the captured pages. 1 2 7 13 14 19 20
The MSP Owner
One request record carries incidents, changes, orders and questions, the service instance picks the team and the SLA targets, and intake is evidenced by email, portal, chat and a CTI link that opens the console from a softphone — that is the single desk I want for sixty clients. The AI side is unusually well documented: the auto-classifier decides category, impact, service instance and team, a triage agent links CIs and chases missing detail, and time tracking sits on the requests my invoices come from. It stops short of the top band because we found no public information on custom dashboards and scheduled reports, or on a mobile app for my technicians. 1 2 7 13 14 19 20 22
The Change & Configuration Manager
Requests arrive by email, portal, chat, monitoring events and CTI softphones, with incidents and service requests told apart by category and SLA targets driven by the service instance; the AI classifier that sets category, impact, instance and team is documented down to its fallback and redirect behaviour, and time tracking, satisfaction feedback and analytics modules exist. What the captured pages do not show is business-hours calendars and escalation detail, scheduled reports, or a mobile app aimed at agents rather than requesters, so I stop short of the top band. 13 14 7 20 19 22 2
The Municipal IT Lead
Requests are documented in real depth: email, portal, computer telephony and virtual-agent intake all become the same request record, the service instance sets the assigned team and SLA targets, and the AI classifier's setting of category, impact and team is explained in the help pages. Templates, SLA management, time tracking and satisfaction feedback are covered, and the status pages handle outage communication. Reporting, though, appears only as an analytics capability by name; we found no public information on business hours, escalation rules or SLA-compliance reporting detail. 2 7 13 14 20
The Solo IT Admin
Email, the portal and phone intake all land in one request record, incidents are their own category with routing, and the service instance picks the team and the SLA targets, with SLA handling described as customised and automated. On top of that, the AI auto-classifier's job is spelled out — it sets category, impact, service instance and team — and time tracking, analytics, knowledge management and the mobile app are all documented. We found no public information on SLA business hours and escalation detail, skills-based routing, or custom dashboards and scheduled reports, which is what keeps this short of the top band. 1 2 7 13 14 19 20
The Skeptic
Intake is genuinely multi-channel — email via the Mail API, monitoring events, a telephony console for analysts and the portal — and the help pages document the request record with categories, service-instance-driven team assignment and SLA targets. AI actions are stated in unusual detail (what auto-classification, triage, closure and knowledge drafting each do), and time tracking and satisfaction feedback are named. We found no public information on SLA business hours and escalation rules, a major incident process, dashboards or scheduled reports beyond an ITSM Analytics label, or a mobile app aimed at agents rather than end users. 13 14 1 2 7
Change, problem & release management
Show reasoningHide reasoning
How this is scored
The ITIL processes behind the ticket: problem records linked to incidents with root cause and known errors, change requests with standard, normal and emergency types, risk and impact assessment, approvals and a change advisory board, a change calendar with blackout periods, release and deployment records, links between changes, problems, incidents and configuration items, process certifications (PinkVERIFY, PeopleCert/AXELOS) named with their scope, and audit trails that a regulated buyer can show an auditor.
0 — No change or problem management of any kind; only tickets.
3 — A change or problem ticket type with a status and an approval step; change types, risk, calendar and links to incidents are basic or not described.
5 — Problem records linked to incidents with root cause and known errors, change requests with standard, normal and emergency types, multi-step approvals, a change calendar, changes linked to incidents and configuration items, and an audit trail of who approved what.
8 — Risk and impact assessment that reads affected services from the CMDB, a CAB workflow with agenda and decisions recorded, blackout periods and collision detection on the change calendar, release management with deployment tasks, change templates for standard changes, and an ITIL process certification named with the processes it covers.
10 — Change and problem management a regulated organisation can be audited on: every process configurable and versioned, change success and failure rates reported, a full trail from incident through problem and change to release exportable, the mapping to ISO/IEC 20000, ITIL 4 or DORA requirements documented, and certifications published with their scope and date.
The Service Desk Lead
A change starts as a request in the RFC category and is carried out by a workflow holding tasks, ordering, approvals and automation, with types, templates, risk assessment and release coordination documented, and problem management targets the underlying issues behind recurring incidents. The audit trail records who created, updated or deleted which record, which an auditor can read. I found no public information on a change calendar with blackout periods, a change advisory board, standard, normal and emergency change types, known errors, or an ITIL process certification. 2 4 15 16
The MSP Owner
A change starts as an RFC request and is executed by a workflow record holding tasks, approvals and automation, with customizable templates, a risk assessment on changes, release coordination and an audit trail showing who touched every record and when — good enough to show a client's auditor. Problem management is present to eliminate the underlying causes of recurring incidents. It sits mid-table because we found no public information on a change calendar, blackout periods, a change advisory board workflow, the standard/normal/emergency change types, or an ITIL process certification. 2 4 15 16
The Change & Configuration Manager
A change starts as an RFC request with its own type field and is executed by a workflow that holds the tasks, approvals and automation, backed by customizable templates, a risk record for change assessment, release coordination and a problem module for recurring incidents. The audit function is the part I would show the regulator: a chronological record of every creation, update and deletion with who and when, viewable through an Auditor role, and postmortems that pull in linked changes and configuration items. I found no public information on a change advisory board workflow with agenda and decisions, a change calendar with blackout periods or collision detection, distinct standard, normal and emergency change types, or an ITIL process certification naming its scope. 15 16 2 4 1
The Municipal IT Lead
The change model is unusually well documented: a change opens as an RFC request and is carried out by a workflow holding tasks, approvals and automation, with templates, risk assessment, release coordination and a full audit trail of every record change with who and when — that trail I could show an auditor. Problem management appears only as a capability statement about underlying issues behind recurring incidents, and we found no public information on standard, normal and emergency change types, a change calendar or CAB decisions. 2 15 16
The Solo IT Admin
Changes are modelled as an RFC request carried out by a workflow holding tasks, ordering and approvals, with an RFC type field, risk assessment on changes, release coordination, and an audit console that records who created, changed or deleted any record and when. Problem management is named as a capability, but we found no public information on problem records linked to incidents with root cause and known errors, a change calendar with blackout periods, or a change advisory board. That is deeper than a mere ticket type, so this sits above the basic level but below the mid band. 1 2 4 15 16
The Skeptic
The change mechanism is documented and coherent: an RFC request with a type field is carried out by a workflow holding tasks, ordering, approvals and automation, with risk assessment and release coordination described, and the audit functionality records who changed what and when, including deletions, for an Auditor role. Problem management, by contrast, is a single marketing sentence — we found no public information on root cause fields, known errors or links from problems to incidents — and a change calendar, blackout periods and a change advisory board are not described either. 15 2 16 1
Assets, CMDB & discovery
Show reasoningHide reasoning
How this is scored
What the product knows about the things tickets are about: an asset inventory of hardware, software and licences, a CMDB with configuration item types, attributes and relationships, a service map or dependency view, agent-based or agentless discovery, imports and synchronisation from Active Directory, Entra ID, Intune, SCCM, JAMF or a discovery tool, software licence compliance, contracts, warranties and the asset life cycle, and assets linked to users, tickets and changes.
0 — No asset or configuration data at all; tickets cannot be linked to devices or services.
3 — A list of assets with basic fields that can be linked to a ticket; relationships, discovery and licences are basic or not described.
5 — An asset inventory of hardware and software, a CMDB with configurable CI types and relationships, network discovery or an inventory agent, an import or sync from Active Directory or Entra ID, contracts and warranties per asset, and assets linked to users, tickets and changes.
8 — A visual service and dependency map used for impact analysis, discovery documented for named platforms (Windows, macOS, Linux, network devices, cloud accounts), connectors to named sources (Intune, SCCM, JAMF, VMware, AWS, Azure), software licence compliance and metering, the full asset life cycle from purchase to disposal, and data quality rules for the CMDB.
10 — A CMDB an organisation can trust for audits and outages: a documented data model with reconciliation of several sources, CI history and change tracking, service models from business service to infrastructure, licence optimisation for named vendors, and every CI and relationship exportable and reachable by API.
The Service Desk Lead
Configuration items cover hardware, firmware, software and licence certificates, are created from product records with purchase value and warranty expiry, are tracked across the lifecycle with lifecycle reviews, and are tied together through dependency visualization and the Service Hierarchy Browser. Discovery is described as AI-powered with reconciliation rules, a reconciliation queue and CMDB health, and the documented recommendation is that system management tools maintain the technical detail via a System ID link. We found no public information on discovery for named platforms, imports from Intune, SCCM, JAMF or Active Directory, or software licence compliance and metering. 1 2 5 17 18
The MSP Owner
The CMDB here is documented, not marketing: configuration items cover hardware, firmware, software and licence certificates with warranty and purchase fields, discovered records pass through a reconciliation queue with rules, and there is CMDB health reporting, lifecycle reviews, and a service hierarchy browser with dependency visualization for impact. CIs are reachable through the REST and bulk APIs, a triage agent links them to requests, and their history lands in the audit trail. We found no public information on discovery for named platforms or connectors such as Intune, SCCM or JAMF, or on licence compliance and metering. 1 2 5 7 17 18
The Change & Configuration Manager
The configuration management documentation covers registration of configuration items with relations, purchase and warranty fields, products as the source of new items, a lifecycle with reviews, and — what I need before I trust an impact assessment — reconciliation of discovered records through a queue and rules, rule sets, CI automation rules and a CMDB health page. We found no public information on discovery documented per platform such as Windows, macOS or network devices, imports from named inventory sources such as Intune, SCCM or JAMF, or software licence compliance and metering. 17 18 5 2 1
The Municipal IT Lead
The configuration management documentation is genuine help material: configuration items for hardware, software and licence certificates created from product records, purchase value and warranty expiry fields, lifecycle reviews, discovery reconciliation with a queue and rules, CMDB health, and CI linking to requests by the triage AI. Discovery is delegated to external system management tools through a System ID link rather than built-in scanning, and we found no public information on synchronisation from Active Directory or discovery for named platforms. 1 5 17 18
The Solo IT Admin
Asset lifecycle management, warranty and purchase fields on the record, software licence certificates registered as configuration items, reconciliation rules and queue, and CMDB health are all documented, and the AI triage links related configuration items to tickets. The catch for a shop like mine is that the guidance recommends keeping technical detail minimal in Xurrent and letting external system management tools discover and maintain it, and we found no public information on discovery from named platforms such as Intune, SCCM or JAMF. So the inventory and lifecycle story is solid, but laptops will not find themselves here without tools I would have to bring. 1 2 5 17 18
The Skeptic
The help documentation covers a real life cycle — products as CI models, purchase, warranty and licence-certificate fields, configuration item relations, reconciliation rules and a reconciliation queue, CMDB health and lifecycle reviews — plus a service hierarchy browser for dependency views. Discovery is where it thins out: "AI-powered discovery" is the stated phrase and system management tools are expected to maintain technical detail via a System ID link, but we found no public information on named discovery platforms or connectors, and licence compliance and metering are not described. 17 18 5 2
Self-service portal & service catalog
Show reasoningHide reasoning
How this is scored
What employees or clients see: a self-service portal with the service catalog, request forms with fields and approvals per service, ticket status and history for the requester, a searchable knowledge base for end users, announcements and outage notices, a virtual agent or chatbot, password reset or other automated fulfilment, branding and languages, single sign-on for the portal, access from Teams or a mobile app, and satisfaction surveys.
0 — No portal or end-user access of any kind; requests can only be emailed or phoned in.
3 — A web portal where users open tickets and see their status; a catalog, knowledge base and approvals are basic or not described.
5 — A branded portal with a service catalog, request forms with approval steps, an end-user knowledge base with search, ticket status and history, announcements, single sign-on, several languages, and satisfaction surveys after resolution.
8 — A service catalog with conditional forms, costs and delivery times per item, automated fulfilment for named requests (password reset, software install, onboarding), a virtual agent in the portal and in Teams or Slack, deflection measured, portals per client or department, and accessibility (WCAG) stated.
10 — A portal that runs as the front door of the organisation: catalog, forms and fulfilment built without code and reused across IT, HR and facilities, the virtual agent documented with its sources and data use, deflection and satisfaction reported per service, and accessibility conformance published with its level.
The Service Desk Lead
From the portal an end user can submit requests, follow their progress, browse the knowledge base, order from the service catalog, approve workflows and report time, on any device through the mobile app, with branding, single sign-on and satisfaction feedback after resolution. The virtual agent is documented in real depth — knowledge summaries, matching request templates and pre-populating custom fields, degraded-service notices, saved chats and access limited to chosen groups — which is what would deflect my recurring printer and VPN tickets. I found no public information on announcements, additional languages, automated fulfilment such as password reset, or accessibility conformance. 2 6 7 19 20
The MSP Owner
End users submit requests, track progress, browse the knowledge base, order from the catalog, approve workflows and report time from a branded portal that is also available as a phone app — and every portal submission is the same request record with the same service instance and SLA model an analyst works, which is exactly what I need when a client calls. The virtual agent is documented down to template matching, custom-field pre-population, degraded-service awareness and saved chats, and satisfaction feedback is collected from requesters. We found no public information on costs and delivery times per catalog item, automated fulfilment such as password reset, deflection measurement, or accessibility conformance. 2 6 19 20
The Change & Configuration Manager
From the portal an end user submits and tracks requests, searches the knowledge base, orders from the service catalog, approves workflows, works project tasks and reports time, on any device with branding and single sign-on. The virtual agent is documented unusually deeply — template matching with pre-populated custom fields, degraded-service awareness, saved chat history added as an internal note, and a knowledge flywheel from resolved tickets. The captured pages give no costs or delivery times per catalog item, no named automated fulfilment such as password reset, no agent in Teams or Slack, no measured deflection, no languages and no accessibility conformance. 19 20 6 7 2
The Municipal IT Lead
The portal is documented end to end: submitting requests, tracking progress, browsing the knowledge base, ordering from the service catalog, approving workflows and reporting time, with branding design and a phone app, and portal submissions are the same request record under the same service instance and SLA model. The virtual agent is documented precisely — template matching, pre-populated custom fields, degraded-service detection, saved chat history. We found no public information on languages, outage announcements inside the portal, or accessibility conformance, which teachers and clerks here would need. 2 19 20
The Solo IT Admin
From the portal an end user can submit and track requests, browse the knowledge base, order from the service catalog, approve workflows and report time, on any device through the mobile app, with branding, single sign-on and satisfaction feedback on resolution. The virtual agent is unusually well documented — it searches knowledge, matches request templates, pre-populates custom fields and flags degraded services — and portal submissions get the same service instance and SLA treatment as analyst-registered ones. We found no public information on deflection being measured, accessibility conformance, or the virtual agent being reachable inside Teams. 2 6 7 19 20
The Skeptic
The portal is documented end to end — catalog orders, request tracking, knowledge base, workflow approvals, project tasks, time reporting, branding, single sign-on and a phone app — and portal submissions become the same request record an analyst works, with the same SLA model. The virtual agent is documented in rare depth (template matching, pre-populated custom fields, fallback templates, degraded-service awareness, saved conversations), but we found no public information on per-item costs and delivery times in the catalog, automated fulfilment for named requests, accessibility conformance, or the agent running in Teams or Slack. 19 20 2 7
Deployment, integrations & multi-client operation
Show reasoningHide reasoning
How this is scored
How the product is run and connected: a cloud edition and an on-premise or open-source edition with feature parity stated, system requirements and update cadence, a documented REST API and webhooks, integrations with Microsoft 365, Teams, Entra ID, Slack, monitoring tools, RMM and remote support tools, single sign-on (SAML, OIDC) and SCIM, roles and permissions, multi-client or multi-tenant operation with separated data for MSPs, time and contract billing for MSPs, a migration path from other tools, and a public status page.
0 — No documented way to run, connect or administer the product.
3 — Runs as one edition with user roles and an email connection; the API, integrations and other editions are basic or not described.
5 — A documented REST API, integrations with Microsoft 365, Teams and Entra ID or Active Directory, single sign-on, role-based permissions, at least one monitoring or remote support integration, and either an on-premise edition or a stated hosting model with uptime terms.
8 — Cloud and on-premise or open-source editions with feature parity stated, webhooks and an integration marketplace, SCIM provisioning, multi-tenant operation with separated client data for MSPs, time and contract billing, named RMM and monitoring connectors, a documented migration from named tools, and a public status page with uptime history.
10 — Operation at scale and on the customer's terms: open-source code under a named licence or a self-hosted edition with full parity, configuration as code or a staging-to-production transport documented, an API covering every object, high availability and disaster recovery documented, and SLA and support terms published.
The Service Desk Lead
The developer site documents REST, GraphQL, bulk, mail, events and webhooks APIs with a change log and deprecation notices, plus SCIM and just-in-time provisioning, single sign-on, computer telephony integration and role-based permissions. Named standard integrations cover monitoring, security, collaboration and other ITSM tools, there is an integration platform with templated connections and an MCP server, and multi-provider operation is served by account trusts, SIAM and MSP billing into external invoicing tools. I found no public information on an on-premise or self-hosted edition, uptime terms, a public status page for the service itself, or a documented migration path. 2 7 10 21 22
The MSP Owner
This is the strongest area for my kind of business: MSP licence plans, account trusts and trust relations to link client accounts, SCIM and just-in-time provisioning, single sign-on, and time tracking that turns into billable events connected to external invoicing tools. The API surface is deep — REST, GraphQL, bulk, events, webhooks, an MCP server and an iPaaS with templated connectors — alongside named monitoring integrations from Datadog to Zabbix and weekly platform releases. We found no public information on an on-premise edition, a named RMM or remote-support connector, a documented migration path from other tools, or a public status page with uptime history. 2 7 8 10 21 22
The Change & Configuration Manager
The developer site documents REST, GraphQL, bulk, webhooks, events and mail APIs with a change log and deprecation notices, alongside single sign-on, SCIM and just-in-time provisioning, role-based permissions and computer telephony integration, plus an iPaaS with templated connections and named integrations across monitoring, security, ITSM and collaboration. Multi-provider operation is evidenced through account trusts, SIAM positioning, MSP license plans with billing to external invoicing tools, and tenant isolation that keeps AI inside the tenant. We found no public information on an on-premise or open-source edition, a documented migration from named tools, RMM connectors, or a vendor status page with uptime history. 7 21 22 2 8 1 10
The Municipal IT Lead
The integration side is strong: documented REST, GraphQL, bulk, events, mail and webhooks APIs with a change log and deprecation notices, SCIM provisioning and single sign-on, an iPaaS with templated connections, named monitoring and chat integrations, plus account trusts and MSP billing for multi-client operation. It is a cloud service with a choice of processing regions including the EEA; we found no public information on an on-premise or self-hosted edition, a migration path from named tools, or the vendor's own status page and uptime terms — and without a self-hosted option it cannot run in our municipal data centre. 2 7 10 21 22
The Solo IT Admin
The developer site documents REST, GraphQL, bulk, webhooks, mail and events APIs with a change log and deprecation notices, plus SCIM provisioning, single sign-on, and named integrations from Datadog, Splunk and Grafana through Slack and Teams; multi-account operation with account trusts and MSP billing into external invoicing tools is documented, and the platform ships improvements weekly. We found no public information on an on-premise edition, a documented migration path from named tools, or a public status page with uptime history for the service itself. The API story is about as good as it gets publicly, which is what earns the score. 2 7 8 9 21 22
The Skeptic
The integration story is unusually strong: REST, GraphQL, bulk, events, mail and webhooks APIs with a change log and deprecation notices, SCIM and just-in-time provisioning, single sign-on, an iPaaS with templated connectors, an MCP server, and MSP licence plans with account trusts and MSP billing; hosting is cloud-only in a region of the customer's choice including the EEA. Many named monitoring and collaboration connectors are presented for the incident management and response product rather than the service desk, and we found no public information on an on-premise or self-hosted edition, migration tooling from named tools, or a public status page for the vendor's own uptime. 7 21 22 8 2 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where tickets, attachments, user directories and CMDB data are stored and processed, and who the subprocessors are (hosting, email delivery, AI features, support and payment tools). Independently sourced by the sovereignty pipeline; a service desk holds personal data about every employee and often credentials and network details, so the whole chain counts, not only the database. An on-premise or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (email delivery, AI features, support access, payment) run through non-EU providers without a stated safeguard, or the vendor is non-EU with an EU data centre option.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premise edition documented that keeps every record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Service Desk Lead
The contracting entity is Xurrent, Inc. of Austin, Texas, under FTC oversight through the EU-US Data Privacy Framework, so this is a US vendor — but all customer data is stored in a region of the customer's choice including the EEA, on named AWS infrastructure in Ireland and Germany, and the subprocessor list with locations is published, including Google in the US for email hosting. A data processing addendum is available, ISO 27001, ISO 27018, SOC 2 Type II and C5 are attested, bring-your-own-key encryption is included, and the AI runs tenant-confined on AWS Bedrock with no training on customer data. A non-EU parent with no documented EU contracting entity keeps this below the top band for a German buyer like us. 1 8 10 11 12
The MSP Owner
The contracting party is Xurrent, Inc. of Austin, Texas — a US company — but customer data is always stored in the customer's chosen region, including the EEA, on named AWS infrastructure in Ireland and Germany, with subprocessors listed by location; Google for email hosting and Slack for internal communication are US-based. A data processing agreement, EU-US Data Privacy Framework participation, ISO 27001/27018, SOC 2 Type II and C5 are all published, and bring-your-own-key encryption is included. We found no public information on an EU contracting entity or EU representative, which keeps a US-parented chain in the middle band. 1 10 11 12
The Change & Configuration Manager
Customer data is stored within a region of choice that includes the EEA on Amazon Web Services in Ireland and Germany, subprocessors are listed with their locations — Google and Slack in the United States for email and internal communication, Pendo in the EEA — a data processing addendum is published, and ISO 27001, ISO 27018, C5 and SOC 2 attestations plus bring-your-own-key encryption are stated. The contracting entity is nevertheless Xurrent, Inc. of Austin, Texas, resting on the EU-US Data Privacy Framework under FTC oversight, and we found no public information on an EU contracting entity or an on-premise edition, which is what separates this from a genuinely European chain. 10 12 11 1 9
The Municipal IT Lead
The contracting entity is Xurrent, Inc. of Austin, Texas, and the subprocessor list is published: AWS for hosting and AI inference with EEA regions in Ireland and Germany, Google in the United States for email hosting, Pendo in the EEA and Slack in the United States. An EEA processing region, a published data processing addendum, ISO 27001/27018 and C5 attestation and bring-your-own-key encryption are stated — but a US entity with the email chain in the United States under the Data Privacy Framework is exactly what my data protection officer will not sign for staff and device data, and we found no public information on a self-hosted edition that would keep records on our own servers. 1 9 10 11 12
The Solo IT Admin
Xurrent is a US company and the captured pages name only the US entity, but customers can hold all data in the EEA on named AWS regions (Ireland and Germany), a data processing addendum is published, subprocessors are listed with their locations, and ISO 27001, ISO 27018, C5 and SOC 2 are stated alongside EU-US Data Privacy Framework compliance and bring-your-own-key encryption. The subprocessor list shows email hosting running through Google in the United States. For my engineers an EEA region choice plus a published DPA and certifications is workable, and that places this between the non-EU-vendor-with-EU-option level and the full European chain. 1 9 10 11 12
The Skeptic
The chain is documented but the seat is American: the contracting entity is Xurrent, Inc. of Austin, Texas, though customers choose a processing region including the EEA, and the trust page names subprocessors with locations — AWS for hosting and AI inference including Ireland and Germany, Google in the United States for email hosting, Pendo in the EEA, Slack in the United States. A data processing addendum, ISO 27001/27018, SOC 2 and C5 attestations, and EU-US Data Privacy Framework certification are published, which is more transparency than most non-EU vendors show; the entity and parts of the chain remain non-EU regardless. 10 12 11 9 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per agent, technician or analyst and tier, whether requesters and portal users are free, what counts as an asset or node and how it is priced, which modules (CMDB, change, asset discovery, AI, ESM) cost extra, the on-premise licence or subscription and its maintenance, the free or open-source edition and paid support, minimum term, onboarding and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free edition exists, but how cost scales with agents, assets or modules is unclear.
5 — Tiers are public with their price per agent and main inclusions, but at least one commonly needed piece (asset packs, CMDB or discovery, AI features, on-premise licence, onboarding) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (agents, assets, clients), add-ons and asset packs priced, the on-premise licence and maintenance or the open-source support plans priced, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of agents, assets and modules, cloud or on premise, with every add-on, setup, training, support and overage fee and the cancellation and data-return terms published.
The Service Desk Lead
The pricing page names three tiers with their included platform users (10, 50 and 100 per month), scope running from ITSM only to unlimited ESM, support levels, and integration counts of one, three and unlimited, with AI included in every plan at no add-on cost, plus a separate MSP plan family. However, no monetary price appears on the captured pricing page, so I cannot compute an annual cost for my team and 1,400 employees, and onboarding, minimum term and the MSP plans are unpriced as well. The route offered is a personalized demo. 1 8 9
The MSP Owner
The pricing page publishes the tier skeleton — Starter at 10 platform users per month, Corporate at 50, Enterprise at 100 — with functional scope, integration counts, support levels and separate MSP licence plans, and AI is stated as included with "$0 in token pools, session fees, or AI add-on SKUs". But we found no public monetary price for any tier, and no public information on term, onboarding or asset pricing — so a year for twenty-two technicians cannot be computed from public pages alone. 1 8
The Change & Configuration Manager
The pricing page publishes three corporate tiers and separate MSP plans with platform-user counts of ten, fifty and one hundred, functionality per tier, integration limits of one, three and unlimited, support levels and AI included in every plan; we found no public information on any price figure, so a buyer cannot compute an annual cost. We also found no public information on price per platform user, asset or module pricing, minimum term, onboarding fees or VAT treatment. 8 1
The Municipal IT Lead
The plans are public with their structure — Starter 10 Platform Users/Month for ITSM, Corporate 50 Platform Users/Month with limited ESM, Enterprise 100 Platform Users/Month with unlimited ESM — and AI is stated as included in every plan. But the captured pricing pages show no monetary figures at all, and we found no public information on term lengths, asset costs or onboarding, so my procurement office could not budget a tender from them. 1 8
The Solo IT Admin
The pricing page publicly sets out Starter, Corporate and Enterprise tiers by platform users (10, 50 and 100) with what each includes, AI in every plan, and support levels per tier, so the scaling unit is visible. But the captured pricing text contains no price figure in any currency, so I cannot read off what a year costs, and we found no public information on requester pricing, asset pricing, onboarding fees, minimum term or VAT treatment. There is enough tier structure to browse, but not enough to put a number on a budget line. 8 9
The Skeptic
The public page shows a plan ladder — "STARTER 10 Platform Users/Month", "CORPORATE 50 Platform Users/Month", "ENTERPRISE 100 Platform Users/Month" — with functionality, integration counts and support access per plan, and states AI is included at every tier with no add-on fees. But we found no public price in any currency for any tier, and no figures for assets, onboarding, minimum term or the MSP licence plans; a buyer still cannot compute a cost, only a shape. 8 1
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Xurrent ITSM
Is Xurrent ITSM European?
No. whats-best.ai classifies Xurrent ITSM as Rest of world.
Where does Xurrent ITSM store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Xurrent ITSM have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Xurrent ITSM?
As of 2 Nov 2026, the panel rates ManageEngine ServiceDesk Plus (3.5/5), GLPI (3/5) and SysAid (3/5) highest among the other 14 IT Service Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is GLPI (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Xurrent ITSM alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 35 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (23)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.xurrent.com Checked 1 Nov 2026 Details →
- 2 Features page www.xurrent.com Checked 1 Nov 2026 Details →
- 3 Features page (service desk) www.xurrent.com Checked 1 Nov 2026 Details →
- 4 Features page (change management) www.xurrent.com Checked 1 Nov 2026 Details →
- 5 Features page (configuration and asset management) www.xurrent.com Checked 1 Nov 2026 Details →
- 6 Features page (self-service portal) www.xurrent.com Checked 1 Nov 2026 Details →
- 7 API documentation developer.xurrent.com Checked 1 Nov 2026 Details →
- 8 Pricing page www.xurrent.com Checked 1 Nov 2026 Details →
- 9 Company page www.xurrent.com Checked 1 Nov 2026 Details →
- 10 Privacy policy www.xurrent.com Checked 1 Nov 2026 Details →
- 11 Data protection page (GDPR) www.xurrent.com Checked 1 Nov 2026 Details →
- 12 Security / trust page trustcenter.xurrent.com Checked 1 Nov 2026 Details →
- 13 Service desk, incidents & requests — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 14 Service desk, incidents & requests — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 15 Change, problem & release management — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 16 Change, problem & release management — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 17 Assets, CMDB & discovery — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 18 Assets, CMDB & discovery — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 19 Self-service portal & service catalog — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 20 Self-service portal & service catalog — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 21 Deployment, integrations & multi-client operation — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 22 Deployment, integrations & multi-client operation — found from sitemap www.xurrent.com Checked 1 Nov 2026 Details →
- 23 Terms of service — found from the homepage www.xurrent.com Checked 1 Nov 2026 Details →