IT service desk software for regulated and public sector teams: FedRAMP, HIPAA and hosting in 2026

Our rating method scores seven criteria for mid-size IT teams, and compliance is not one of them. For a public sector body, a hospital or a bank, it often decides the shortlist before any score matters. This article collects what vendors announced or state on their pages, dated, so you can check it against your own requirements. Statuses change: confirm each one with the vendor and, for FedRAMP, on the FedRAMP Marketplace.

Self-managed options carry their own dates. Atlassian's September 2026 public sector post ties its cloud programme to the Data Center end-of-life date of 28 March 2029 [Atlassian blog]. If you plan to run Jira Service Management Data Center, check that date against your contract term.

• 13 August: Halo said its multi-tenant cloud platform achieved FedRAMP certification at the Moderate impact level under the FedRAMP 20x programme, and is listed on the FedRAMP Marketplace [Halo news].
• 6 August: Freshworks said Freshservice achieved 'In Process' status toward FedRAMP Class C (Moderate), with AWS GovCloud (US) as the planned infrastructure [Freshworks press release]. In Process is a step on the way, not an authorisation.
• 23 September: Atlassian moved its DoD Impact Level 5 submission forward by six months to July 2028, with FedRAMP High submission following in January 2029. Jira Service Management is among the initial products [Atlassian blog].

Read vendor statements for what they are: the vendor's description of its status on the date it published. The FedRAMP Marketplace is the place to confirm the current status and impact level before procurement.

monday service lists 'HIPAA Compliance' on its Enterprise plan, and its service page names GDPR, SOC 2, ISO and HIPAA [monday pricing] [monday service page]. Of the pricing pages we read, it is the only one that names HIPAA in a plan table. That does not mean the other vendors lack it: we did not record HIPAA terms for the other eight on the pages we read. For any vendor, ask whether it will sign a business associate agreement (BAA), and on which plan.

Sometimes. Halo's August 2026 notice on its move to AWS EKS says IT teams must update firewall rules for new egress IP ranges, that custom domain customers need DNS changes for certificate validation, and that API calls will need a User-Agent header. It sets a beta from September 2026 and general availability for Stable channel customers in Q1 2027 [Halo news]. In regulated environments, where firewall and change approvals take time, ask every vendor how much notice it gives for infrastructure changes.

1. Which certifications or authorisations apply to the plan and region we would buy, and can we see the evidence?
2. Where is our data stored and processed, including AI processing?
3. Which AI providers process ticket content, and can we switch AI features off?ServiceDesk Plus Cloud added Claude as an AI provider in September 2026 [ManageEngine release notes], so provider lists do change.
4. For self-managed editions, what are the end-of-life and support dates?
5. How much notice do you give before infrastructure, IP range or API changes?
6. Will you sign a BAA or a data processing agreement, and on which plan?

Then run the rest of our buyer's checklist and compare scores on the ranking. For deployment detail per vendor, see the reviews of ServiceDesk Plus, Ivanti, Jira Service Management and Halo.