> Understand how Combodo iTop, an open source self hosted ITSM and CMDB tool, handles cookies, EU hosting and GDPR obligations for internal IT staff use. > > Canonical: https://www.flowconsent.com/en/services/customer-support/combodo-itop Customer support # Combodo iTop Preferences · [Official website](https://www.combodo.com/itop-193) Combodo iTop is an open source ITSM and CMDB platform for IT service desks, asset management and ITIL processes, self hosted or available as the EU based iTop Hub SaaS. [Block Combodo iTop until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Preferences - Prior consent Not required - Documented cookies 6 - Third-party domains 7 - Servers Customer choice when self hosted, EU (France) by default on the Combodo iTop Hub SaaS variant Overview ## What does Combodo iTop do? ## **What Combodo iTop is and what it does** Combodo iTop is an open source IT Service Management and Configuration Management Database platform developed by Combodo SAS in Grenoble, France. It implements ITIL aligned processes such as incident, problem, change, service request, configuration and SLA management on top of a PHP and MySQL stack. The software is licensed under AGPL and is typically deployed on the customer's own infrastructure as an internal backoffice application used by IT staff. Combodo also offers iTop Hub, a SaaS variant hosted in the European Union, alongside consulting and support services. ## **Data and cookies set by Combodo iTop** iTop processes data that IT operations generate, including user accounts of IT staff and end users with tickets, incident and change records, configuration items in the CMDB, asset inventories, contracts and SLA metrics. From a web technology perspective the application only sets first party functional cookies, typically itop-cookie, PHPSESSID for the session, itop-user-prefs for user interface preferences and itop-token for CSRF protection. These cookies are server set, scoped to the iTop hostname and used solely to authenticate staff and maintain a working session. No advertising, profiling or cross site tracking technologies are loaded by default. ## **GDPR and ePrivacy implications** Under the GDPR the organisation operating iTop is the controller for the personal data stored in tickets, asset and user records, while Combodo acts as processor only for the iTop Hub SaaS variant. ePrivacy obligations are limited because iTop is not a public website tracker and its cookies are strictly necessary to authenticate staff and protect against CSRF, which falls under the Article 5(3) exception of the ePrivacy Directive. The main GDPR work consists of documenting records of processing, defining retention periods for incidents and audit logs, securing access and ensuring data subject rights for staff and end users referenced in tickets. ## **Consent requirements and legal basis** No cookie banner consent is required for the functional session cookies used by iTop because they are strictly necessary to deliver the requested service to authenticated users. The lawful basis for processing through iTop is normally a combination of legitimate interest under Article 6(1)(f) for IT operations and information security, contract performance under Article 6(1)(b) where the data subject is an employee or customer of the operator, and national employment law. Where iTop captures employee performance data through ticket metrics, employers must observe local employment law and any works council consultation obligations. ## **Cross border transfers and practical compliance steps** When iTop is self hosted on the customer's own EU infrastructure there are no third country transfers, and the iTop Hub SaaS option is hosted on French and EU providers such as OVH and Scaleway by default, so transfers outside the EEA are not part of the standard configuration. Practical compliance steps include restricting administrator access, enabling LDAP or SSO with multi factor authentication, configuring retention rules to archive or purge closed tickets, recording iTop in the records of processing, signing an Article 28 contract with Combodo when using iTop Hub, and updating the internal privacy notice for IT staff. Compliance ## Combodo iTop and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for IT operations and security, contract performance (Art. 6(1)(b)) with the employer for staff use, and applicable national employment law for processing employee data through the ITSM tool. - Risk level low - Applicable regulations GDPR (the operating organisation is controller), ePrivacy Directive (mostly inapplicable since cookies are strictly necessary for staff authentication), French and EU employment law for IT staff use ### Impact assessment (DPIA) A DPIA is generally not required just because iTop is deployed, since it is an internal backoffice ITSM tool used by IT staff under the controller's authority. A DPIA may still be appropriate when iTop stores special category data, very large volumes of incident or HR linked records, or when it is integrated with monitoring tools that produce systematic evaluation of employees. Document the records of processing, restrict admin access, log changes and review retention of incident and asset data. ### Sample text for your banner > No cookie banner consent is required for the strictly necessary session cookies set by Combodo iTop. Inform IT staff in an internal privacy notice that iTop is used to manage incidents, changes, assets and user accounts, and explain the legal basis (legitimate interest and contract performance with the employer), the retention periods and their rights as data subjects. Cookies and trackers ## What Combodo iTop sets and contacts - Tracking method Server side PHP application with admin/agent login, minimal front end JavaScript and first party functional session cookies for authentication - Server location Customer choice when self hosted, EU (France) by default on the Combodo iTop Hub SaaS variant ### Cookies set (6) | Name | Type | Duration | Purpose | | ---------------- | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | PHPSESSID | functional | session | Standard PHP session identifier issued by the iTop server to keep the authenticated user logged in during a working session. Strictly necessary. | | itop-cookie | functional | session | Application session cookie set by iTop to maintain login state and user context between page loads. Strictly necessary, first party. | | itop-user-prefs | functional | 1 year | Stores per user interface preferences such as language, list filters and pagination so the agent finds the same configuration on next login. | | itop-token | functional | session | Anti CSRF token used by iTop to protect form submissions and API calls from cross site request forgery. Strictly necessary security cookie. | | XSRF-TOKEN | functional | session | Additional CSRF protection token that some iTop installations or reverse proxies set. Exact name depends on configuration. Strictly necessary. | | itop-remember-me | functional | 30 days | Optional persistent authentication cookie issued when the user ticks the remember me option at login, so the session can be resumed without retyping credentials. | ### Third-party domains contacted (7) - `combodo.com` - `combodo.fr` - `itophub.io` - `community.combodo.com` - `support.combodo.com` - `wiki.openitop.org` - `store.itophub.io` Questions ## Frequently asked questions about Combodo iTop Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies or identifiers does Combodo iTop set? iTop sets only first party functional cookies on the application hostname: itop-cookie, PHPSESSID for the session, itop-user-prefs for interface preferences and itop-token for CSRF protection. There are no advertising or analytics identifiers by default. ### Is consent required before loading Combodo iTop? No cookie banner consent is needed. The session and CSRF cookies are strictly necessary to authenticate IT staff, so they fall under the Article 5(3) ePrivacy exception. Inform users via the internal privacy notice instead. ### What is the legal basis for processing with Combodo iTop? The operating organisation typically relies on legitimate interest under Article 6(1)(f) for IT operations and security, contract performance under Article 6(1)(b) for staff and customers, and applicable employment law when iTop processes employee data. ### Does Combodo iTop transfer data outside the EU? No when the software is self hosted on EU infrastructure. The iTop Hub SaaS variant is hosted in France and the EU by default (OVH, Scaleway), so transfers outside the EEA are not part of the standard configuration. ### Do I need a DPIA before deploying Combodo iTop? Generally no, because iTop is an internal backoffice tool used by IT staff under the controller's authority. A DPIA may still be appropriate where iTop stores special category data, very large ticket volumes or feeds systematic employee evaluation. ### How do I implement Combodo iTop compliantly? Host iTop on EU infrastructure or use iTop Hub, enable SSO or LDAP with multi factor authentication, restrict admin roles, configure retention to archive or purge closed tickets, record iTop in your processing register and sign an Article 28 contract for the SaaS variant. ### Are there alternatives to Combodo iTop? Yes. Open source alternatives include GLPI (French), Zammad (German), OTRS and OsTicket. Commercial SaaS options include Jira Service Management, ServiceNow and Freshservice. Pick based on hosting region, ITIL coverage and CMDB depth. ### How do I update my cookie policy for Combodo iTop? You usually do not need to mention iTop in a public cookie policy because it is a backoffice tool with strictly necessary cookies. Instead document iTop in the internal staff privacy notice and the records of processing, listing the data categories, retention periods and lawful basis. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [Tars](https://www.flowconsent.com/en/services/customer-support/tars) [Tars is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Tars integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Tars helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/tars) [Preferences](https://www.flowconsent.com/en/services/customer-support/tars) · ### [Wikit Live Chat](https://www.flowconsent.com/en/services/customer-support/wikit-live-chat) [Wikit Live Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. Wikit Live Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, Wikit Live Chat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/wikit-live-chat) [Preferences](https://www.flowconsent.com/en/services/customer-support/wikit-live-chat) · ### [Dotdigital Chat](https://www.flowconsent.com/en/services/customer-support/dotdigital-chat) [Dotdigital Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. Dotdigital Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, Dotdigital Chat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/dotdigital-chat) [Preferences](https://www.flowconsent.com/en/services/customer-support/dotdigital-chat) · ### [Provide Support](https://www.flowconsent.com/en/services/customer-support/provide-support) [Provide Support is a customer support and helpdesk platform that helps businesses manage, track, and resolve customer inquiries efficiently. It provides a unified ticketing system, knowledge base, and multi-channel support across email, chat, phone, and social media. Provide Support features automated ticket routing, SLA management, and self-service portals, enabling faster resolutions, higher satisfaction, and reduced operational costs for support teams.](https://www.flowconsent.com/en/services/customer-support/provide-support) [Preferences](https://www.flowconsent.com/en/services/customer-support/provide-support) · ### [Aimy](https://www.flowconsent.com/en/services/customer-support/aimy) [Aimy is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Aimy integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Aimy helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/aimy) [Preferences](https://www.flowconsent.com/en/services/customer-support/aimy) · ### [WhatsApp Business Chat](https://www.flowconsent.com/en/services/customer-support/whatsapp-business-chat) [WhatsApp Business Chat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. WhatsApp Business Chat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, WhatsApp Business Chat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/whatsapp-business-chat) [Preferences](https://www.flowconsent.com/en/services/customer-support/whatsapp-business-chat) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)