ITSM platforms with SOC 2 and HIPAA compliance and full audit trails

Serval, Jira Service Management, ServiceNow, and Freshservice all hold SOC 2 attestations, but they differ on HIPAA terms, on where you can run them, and on what the audit trail records when automation does the work. Serval is SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, and GDPR compliant, and it logs every access request, approval, grant, and revocation, plus each step of every workflow run, as the work happens.

This guide is for IT and security leaders who answer to SOC 2, HIPAA, or ISO 27001 auditors. It compares four platforms on certifications, HIPAA terms, audit trail depth, access review evidence, and self-hosted deployment options.

What compliance-ready ITSM platforms need to provide

Four things matter when you evaluate vendors.

1. Certifications on the platform itself. A SOC 2 Type II report means an independent auditor tested the vendor's controls over a period of time, usually 3 to 12 months. SOC 2 Type I covers a single point in time, and a self-attested questionnaire isn't an audit at all. Ask for the current report and bridge letter, since a badge on a website isn't evidence.

HIPAA is a federal law with no certification of its own. What matters is whether the vendor will sign a Business Associate Agreement (BAA), which products and plans it covers, and what configuration it requires before you store protected health information (PHI).

2. Audit trail completeness. Does the platform log every automated action, or only ticket events? A useful audit log records who or what triggered an action, the inputs, each step's output, and an exact timestamp. Check how long logs are kept, whether you can export them, and whether a reviewer outside IT can read them.

3. Access review support. For SOC 2 and ISO 27001, auditors expect a documented record of who had access to what, when it was granted, who approved it, and when it was revoked. Your ITSM should produce that record as a one-click export.

4. Data control options. For HIPAA and data residency requirements, ask whether you can choose a data region, run part of the platform in your own infrastructure, or run all of it there. For some regulated teams, a cloud-only option is a hard stop.

The criteria used to evaluate each platform in this article

Which ITSM platforms meet SOC 2, HIPAA, and audit trail requirements?

1. Serval

Serval's trust center states that Serval is SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, and GDPR compliant. Serval achieved ISO/IEC 27001:2022 certification in May 2026, and the SOC 2 Type II report, bridge letter, and certificates are available on request through the trust center.

Serval logs the full access lifecycle (request, approval, provisioning, and automatic revocation) and every step of every workflow run, so the audit evidence exists the moment the work happens.

Serval's automation is deterministic, which makes it auditable. Catalyst, Serval's automation agent, drafts each workflow as TypeScript from a plain-language description, and your team can edit the code directly. Once published, a workflow runs exactly as written, and an LLM appears in a run only if your team adds a step that calls one. You can hand a workflow to a security reviewer the same way you'd hand over application code.

Every workflow run is logged step by step: who or what triggered it, when it started and finished, and each step's input, output, status, and any error. Run history is also available through Serval's public API, so you can pull runs into your own reporting.

Serval tracks every published version of a workflow with who published it and when, and you can restore an earlier version. The Serval CLI pulls workflows as files you can keep in Git and pushes changes back, so automation can go through the same code review as application code.

Access Management applies policies with time limits, approvals, and justification requirements to every request, provisions the access, and removes it automatically when time expires. The entire lifecycle, from request to revocation, is logged, with exportable logs for compliance.

User access reviews snapshot every grant in scope, assign reviewers to certify or revoke each one, and remind them in Slack, Microsoft Teams, and email. The finished review exports as an XLSX or CSV report, which serves as access-certification evidence for SOC 2 and ISO 27001.

Serval's organization audit log records approvals, access review decisions, knowledge changes, and user account changes. Admins can export it as CSV or stream every audit event to a SIEM such as Splunk or Datadog.

Serval's team roles separate ticket work from automation work: Agents resolve tickets, Builders create and publish workflows, and Managers configure integrations and run access reviews. The Help Desk Agent can only call published workflows and handle access requests under your access policies.

Serval's cloud runs in a US or EU region you pick when the organization is created. For stricter requirements, Hybrid Self-Hosted runs the Serval worker in your infrastructure, where selected integration credentials can stay in your cluster, and BYOC on AWS runs the full application single-tenant in an AWS account you own, with its databases kept there.

With the Vanta integration, Serval workflows can read compliance data from Vanta, such as people, vendors, controls, and documents, and upload documents to it, on demand or on a schedule.

Security leaders at Together AI and Perplexity describe how Serval controls who gets access and for how long.

Todd Thiel, Senior Manager of Enterprise Security at Together AI, says: "Serval is performing all of the authorization logic for granting access to infrastructure for us, and it's doing it in a transparent way." Together AI automates 95% of its just-in-time access requests with Serval, and access is deprovisioned automatically, so removal doesn't depend on someone remembering.

Kyle Polley, Security at Perplexity, says: "Serval helps us practice the principle of least privilege by working with employees to identify the minimum level of access required, and ensuring it is granted only for the necessary duration. It's becoming an extension of our security team."

At Mercor, engineers post SQL queries in Slack, Serval validates them and routes them to 14 database administrators who approve with a single click, with complete audit trails of who requested what and why.

2. Jira Service Management

Atlassian publishes SOC 2 reports for its cloud products and holds ISO/IEC 27001:2022 certification. Jira, Confluence, and Jira Service Management hold FedRAMP Certification Class C (formerly FedRAMP Moderate). On Standard, Premium, and Enterprise plans, Atlassian's data residency lets you choose whether Jira Service Management data is hosted in a defined geographic location, such as Europe or the US.

For HIPAA, Atlassian signs a Business Associate Agreement with customers on Standard, Premium, or Enterprise plans, and lists Jira Service Management among the relevant products. Customers must follow Atlassian's implementation guide before entering any PHI.

On audit trails, Atlassian Guard adds audit logs across Atlassian cloud, and each automation flow keeps an audit log with the trigger time, status, and the details of each step, stored for the past 90 days.

Unlike Jira Service Management, where automation flows are assembled from triggers, conditions, and actions or created with Rovo, each Serval workflow is TypeScript your team can read and edit line by line.

3. ServiceNow

ServiceNow's compliance page lists an annual SOC 2 Type 2 attestation since 2013 and ISO/IEC 27001 certification since 2012, and also lists ISO/IEC 42001, 27017, 27018, and 27701. Its Government Community Cloud holds a FedRAMP High Provisional Authority to Operate and meets CNSSI 1253F Privacy Overlay High PII + PHI control requirements.

For HIPAA, ServiceNow's HIPAA white paper says customers can store ePHI in their instance "provided they enter into a BAA with ServiceNow," and must tell ServiceNow first through their sales support representative.

On audit trails, the same white paper says the platform "generates detailed log and activity information that is stored in tables within a customer's instance," and customers manage application logging from within that instance.

Serval can run alongside ServiceNow with two-way ticket sync, so teams can add Serval's access logs and step-level run history while ServiceNow stays the system of record.

4. Freshservice

Freshworks' trust center lists SOC 2 Type 2, ISO/IEC 27001:2022, and ISO/IEC 27701:2019, and its Data Processing Agreement is available without a request.

For HIPAA, Freshworks says it may sign a Business Associate Agreement, and the BAA stays valid only while customers follow its mandatory configuration specifications for Freshservice.

On audit trails, Workflow Execution Logs monitor automations built in Workflow Automator, and the Enterprise plan adds audit logs that track changes under the Admin section. Freshservice builds workflows in a drag-and-drop editor.

How to choose the right compliance-ready ITSM for your team

Start from what your auditors and your compliance framework require, then check each vendor's evidence against it.

If your auditors want evidence for every access grant, look for a platform that writes the record when the request, approval, grant, and revocation happen. Serval logs that whole lifecycle and removes access automatically when the approved window ends.

If you'll store PHI, get a signed BAA and confirm which products, plans, and settings it covers. ServiceNow requires a BAA and advance notice before you store ePHI, Atlassian's BAA requires a Standard, Premium, or Enterprise plan, and Freshworks ties its Freshservice BAA to mandatory configuration settings. Serval lists HIPAA on its trust center; ask Serval for its BAA terms as you would with any vendor. BYOC on AWS keeps Serval's databases in your AWS account.

If you need to prove what automation did, check whether each run is logged step by step. In Serval, every published workflow runs as fixed TypeScript, with an LLM step only where your team adds one, and each run records every step's input, output, and status.

If you need self-hosted or hybrid deployment, Serval offers Hybrid Self-Hosted, which runs the worker in your infrastructure, and BYOC on AWS, which runs the full application single-tenant in your AWS account. Other vendors have self-managed options too, such as Jira Service Management Data Center (closed to new customers since March 30, 2026; support ends March 28, 2029), so check each vendor's current deployment terms.

Choose Serval when your auditors want evidence created as the work happens, for every access grant, every revocation, and every automated step.

FAQ

Which ITSM platforms are SOC 2 and HIPAA compliant?

Serval is SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, and GDPR compliant, according to its trust center. Atlassian publishes SOC 2 reports for Jira Service Management and signs a BAA on Standard, Premium, or Enterprise plans. Freshworks lists SOC 2 Type 2 for Freshservice and may sign a BAA tied to mandatory configuration settings. ServiceNow lists an annual SOC 2 Type 2 attestation and offers a BAA for customers storing ePHI. Ask each vendor for its current report and BAA terms.

Which platforms log every access grant and revocation automatically?

Serval logs the full access lifecycle automatically: the request, the approval, provisioning, and the automatic revocation when access expires. Approvals and access review decisions also land in its organization audit log, which admins can export as CSV or stream to a SIEM, and user access reviews export an XLSX or CSV report for SOC 2 and ISO 27001 evidence.

What's the best ITSM for healthcare organizations with HIPAA requirements?

Ask each vendor for its BAA terms in writing, then check the audit trail and where data lives. Serval lists HIPAA on its trust center, logs every access grant and revocation, and can run single-tenant in your own AWS account with BYOC on AWS. ServiceNow and Jira Service Management offer BAAs with notice or plan conditions, and Freshworks may sign one tied to configuration settings.

Which ITSM platforms offer self-hosted or hybrid deployment?

Serval offers both. Hybrid Self-Hosted runs the Serval worker in your infrastructure while Serval operates the backend, and selected integration credentials can stay in your cluster. BYOC on AWS runs the full Serval application single-tenant in an AWS account you own, with its databases kept in that account. Other vendors have self-managed options too, such as Jira Service Management Data Center (closed to new customers since March 30, 2026; support ends March 28, 2029), so check each vendor's current deployment terms.

Is Serval ISO 27001 certified?

Yes. Serval achieved ISO/IEC 27001:2022 certification in May 2026, and its trust center also lists SOC 2 Type II, ISO 42001, HIPAA, and GDPR. The certificate is available on request through the trust center.