AI Agents & Assistants
Omnifact
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Omnifact GmbH · omnifact.ai
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Omnifact at a glance
- Vendor
- Omnifact GmbH
- Headquarters
- Not stated on the vendor’s pages as of 26 Oct 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 26 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 26 Oct 2026
- Panel verdict
- The AI panel rates Omnifact 3.5/5, the mean of 6 judges. Omnifact is an AI assistant and agent platform from Omnifact GmbH, aimed at the public sector and regulated industries. how scores are made
- As of
- Vendor pages captured 26 Oct 2026; evaluated by the panel 28 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Omnifact is an AI assistant and agent platform from Omnifact GmbH, aimed at the public sector and regulated industries. Sovereignty scores cluster at 8: a German-law contract with Frankfurt jurisdiction, customer data processed in Microsoft Azure Germany West Central with backups staying in Frankfurt, a mandatory Article 28 data processing agreement, named subprocessors, and an ISO/IEC 27001:2022 certificate. Processing and models as well as admin and access score 7 to 8, with providers deactivatable per organization and per space, per-group EU-only routing, SAML 2.0 sign-on and append-only audit logs kept at least 90 days. The weakest areas are data use and training and agent capabilities, both at 4 to 6: judges found no public statement on whether prompts, files or outputs train any model, and none on agent run logs, triggers, schedules or evaluation tooling, while the terms exclude the accuracy of the software's evaluations from the contracted services. Pricing transparency sits at 5 to 6, with the Pro plan public at €25 per user per month paid annually for teams up to 50 users and Enterprise priced only on request.
Speaks for it
- Customer data is processed in Microsoft Azure Germany West Central (Frankfurt) with backups remaining in Frankfurt, under German law with Frankfurt jurisdiction.
- Model providers are named — Azure OpenAI, OpenAI, Anthropic, Google, Mistral AI and custom providers — and can be deactivated per organization and per space, with bring-your-own-key, self-hosted models and on-premises deployment documented.
- SAML 2.0 single sign-on with Microsoft Entra ID, organization-wide enforced two-factor authentication, and append-only audit logs kept at least 90 days.
- A mandatory Article 28 data processing agreement is concluded at registration, retention is configurable by the administrator, and a privacy filter strips personal data from prompts before they reach a model provider.
- Every write action waits for user confirmation by default, integrations require admin approval, and staff connect their own accounts so source permissions carry over.
Held against it
- We found no public statement on whether prompts, files or outputs are used to train any model, the vendor's or a provider's.
- We found no public information on per-agent run logs, triggers or schedules, or on test-and-evaluation tooling before release, and the terms explicitly exclude the accuracy of the software's evaluations from the contracted services.
- The Enterprise tier — where single sign-on, on-premises hosting and self-hosted models sit — is priced only as custom, and we found no published overage rate for premium-model credits beyond the pooled monthly allowance.
- The terms state that LLM providers' technical reasons may require server locations in the USA or outside the EEA, and US-based services such as Brave and SendGrid remain in the subprocessor chain.
- We found no public information on source citations for grounded answers, on webhooks, or on SCIM provisioning and SIEM export of audit logs.
Best for
- You are a public-sector or regulated-industry team in Europe that needs EU-based hosting of platform data, a German-law contract and a mandatory Article 28 DPA.
- You want admin control over which models and hosting regions each user group may use, including EU-only routing and per-provider deactivation.
- You run a team of up to 50 users and want a published price — €25 per user per month paid annually — with a 10-day trial and no credit card required.
- You want agents that act in tools such as Jira, Confluence and HubSpot while every write waits for confirmation.
Avoid if
- Your procurement requires model inference to remain within the EEA in every case, since the terms reserve USA or non-EEA server locations when a provider's technical reasons require them.
- You need a contractual guarantee on the accuracy of AI outputs, which the terms explicitly exclude from the contracted services.
- You must budget a deployment above 50 users from public prices, since Enterprise is priced only on request.
- You depend on support during evaluation, since the terms state that no maintenance or support obligations apply to the trial version.
The scores
| Criterion | Panel median |
|---|---|
| Data use, training & retention | 2.5 of 5 |
| Models & processing location | 4 of 5 |
| Admin, identity & access controls | 3.5 of 5 |
| Integrations, connectors & knowledge | 3.5 of 5 |
| Agent capabilities & guardrails | 3 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 2.5 of 5 |
Data use, training & retention
Show reasoningHide reasoning
How this is scored
What happens to prompts, uploaded files, connected data and outputs: whether any of it trains a model (the vendor's or a model provider's), how long it is kept and where logs live, whether zero-retention is available, and whether a data processing agreement covers it.
0 — No statement on training or retention; the privacy policy is a website policy that does not cover the product.
3 — A general statement that business data is "not used for training", with no word on retention, on the model providers behind the product or on logs.
5 — Business data excluded from training by contract, retention periods stated for chats and files, and a DPA offered to business customers.
8 — No-training commitments stated for the vendor and every model provider it routes to, retention configurable by the admin (including deletion of chat history), zero-data-retention terms with the model providers named, and abuse-monitoring retention described.
10 — Data use fully accounted for: training, retention, logging and abuse monitoring stated per model provider, customer-controlled retention and deletion with an audit trail, outputs and connected data treated as customer data in the DPA, and an independent audit (SOC 2, ISO 27001 or ISO 42001) covering the product.
The Head of IT
An Article 28 Data Processing Agreement is a mandatory part of signup, retention is set by the organization administrator with deletion of chats, users and organizations documented and executed within 30 days, and logs are held append-only for at least 90 days. What I still cannot answer for my own risk assessment: we found no public information on whether prompts, files or outputs are used to train any model, on zero-retention terms with the named model providers, or on abuse-monitoring retention. 4 5 6 7
The Data Protection Officer
A mandatory Article 28 data processing agreement is concluded electronically at registration, retention is configurable by the organisation's administrator, and deletion of chats, users and whole organisations is documented with a 30-day window, append-only audit logs kept at least 90 days, and stated periods for technical and billing data; a privacy filter strips personal data from prompts and files before they reach any model provider. We found no public information on training exclusion for Omnifact or for any of the named model providers, nor on zero-data-retention terms with them, which is exactly the clause I would want signed before client files touch this platform. 4 5 6 7
The Automation Lead
A mandatory Article 28 data processing agreement is concluded at registration, an admin can configure retention, and deletion of chats, users and whole organizations is implemented with a 30-day organization-deletion commitment, append-only audit logs kept at least 90 days, and an ISO 27001-certified ISMS. The captured pages give no statement on whether prompts, files or outputs train the vendor's or a model provider's models, nor on zero-data-retention terms with those providers, which is what holds this below the top band. 4 5 6 7
The Customer-Service Director
The Data Processing Agreement is a mandatory part of the contract at registration, retention is configurable by the organisation's administrator, deletion of chats, users and organisations is technically implemented and carried out within 30 days, and log retention is documented for technical logs, log files and append-only audit logs kept at least 90 days. For a contact centre running forty agents through it, the open question is the big one: I found no public information on whether prompts, uploaded files or outputs train any model, and none on zero-data-retention terms with the model providers. 4 5 6 7
The Works Council Member
A Data Processing Agreement under Art. 28 GDPR is a mandatory prerequisite of the contract, retention is configurable by the organisation's administrator, deletion of chats, users and organisations is technically implemented, and log retention periods (up to 30 days for log files, at least 90 days for append-only audit logs) are written down — that is the kind of written prompt-and-log rule a works council needs. However, we found no public statement on whether prompts, files or outputs train any model, the vendor's or a provider's, and that silence is not something I can accept on staff input. 4 5 6 7
The Skeptic
Retention and deletion are documented in unusual depth: logs up to 30 days and platform logs 6–12 months, retention configurable by the organization's administrator, deletion of chats and organizations implemented within 30 days, a mandatory Article 28 DPA concluded at registration, and prompts stripped of personal data before transmission to any model provider. What I could not find on any captured page is the first thing I ask: a statement of whether prompts, files or outputs train any model, the vendor's or a provider's. Credit for the paperwork; the training question stays open. 4 5 6 7
Models & processing location
Show reasoningHide reasoning
How this is scored
Which models sit behind the product and who runs them, where inference and storage happen, whether the customer can pin processing to the EU, choose or exclude model providers, bring its own model or key, or run the product in its own cloud or on premises.
0 — The models behind the product and the processing location are not stated.
3 — The model family is named, but where inference runs and through which provider (the model maker, a hyperscaler, the vendor) is unstated.
5 — Models and their providers named, with an EU processing option stated for storage and at least the default model.
8 — Each available model listed with provider and inference region, EU-only processing selectable by the admin and enforced across models, model providers excludable, and bring-your-own-key or own-cloud deployment documented.
10 — Processing fully under the customer's control and documented: EU-only or on-premises inference for every feature including agents and connectors, open-weight or self-hosted models supported, data flows per feature published, and a residency commitment in the contract rather than on a marketing page.
The Head of IT
Models from Azure OpenAI, OpenAI, Anthropic, Google and Mistral AI are listed in tiers, model providers can be activated or deactivated per organization, self-hosted and custom models can be connected, and managed, own-cloud and on-premise deployment are documented — a real alternative to "trust us". Group permissions let me pin specific user groups to EU-only routing, with Gemini and Anthropic served via Vertex AI region europe-west; the terms do state that technical reasons at the model providers may require server locations outside the EEA, so EU-only is selectable rather than guaranteed for every model, and per-model inference regions are not published in full. 2 4 6 8 9 13
The Data Protection Officer
Providers are named — Azure OpenAI, OpenAI, Anthropic, Google, Mistral AI and custom providers — with Gemini and Anthropic delivered under EU hosting via Google Vertex AI region europe-west, and administrators can select EU-only routing per user group, deactivate providers per organisation and space, bring their own key or self-hosted model, and choose managed, own-cloud or on-premises deployment. The terms state EEA servers are the target but that model providers' technical reasons may require locations in the USA or outside the EEA, and we found no public information on the inference region for each individual model. 2 4 6 8 9
The Automation Lead
Providers are named (Azure OpenAI, OpenAI, Anthropic, Google, Mistral, plus custom providers), customers can deactivate providers per organization and even per space, and admins can pin user groups to EU-only routing with Gemini and Anthropic served from Google Vertex in europe-west. Bring-your-own-key, self-hosted LLMs and on-premise or own-cloud deployment are all documented with customer data in Azure Germany West Central (Frankfurt); the terms do say a provider's technical reasons can force USA server locations, and a complete per-model inference-region list is not published. 2 4 6 8 9
The Customer-Service Director
The model providers are named — Azure OpenAI, OpenAI, Anthropic, Google, Mistral AI and custom providers — the platform and privacy filtering run on Azure Germany West Central in Frankfurt, administrators can set EU-only routing per user group, customers can deactivate providers themselves, and bring-your-own-key, self-hosted models, own cloud and on-premises deployment are all documented. It stops short of full control: the terms state that technical reasons of the LLM providers may require server locations in the USA or outside the EEA, and an inference region per model is not published for every model. 2 4 6 8 9
The Works Council Member
The model providers are named — Azure OpenAI, OpenAI, Anthropic, Google, Mistral and custom providers — administrators can set per-group routing including EU-only, deactivate providers per organisation and space, and bring-your-own-key, self-hosted models, own-cloud and on-premises deployment are all documented. The terms themselves disclose that technical reasons of the model providers may require server locations in the USA, and per-model inference regions are documented only for Gemini and Anthropic via Google Vertex in region europe-west, which keeps this from the top. 2 4 7 8 9
The Skeptic
The providers are named — Mistral AI, OpenAI, Microsoft, Anthropic, Google, plus self-hosted LLMs and bring-your-own-key — customers can deactivate providers per organization and per space, and group permissions can pin teams to EU-only routing, with Gemini and Anthropic hosted via Google Vertex in region europe-west and further models Azure-hosted. But the terms reserve that LLM providers' technical reasons may require USA server locations, and I found no per-model list of inference regions. Close to the top tier, with that reservation sitting in the contract itself. 2 4 6 7 8 9
Admin, identity & access controls
Show reasoningHide reasoning
How this is scored
What the IT department controls: SSO and SCIM provisioning, roles and groups, which models, agents and connectors each group may use, retrieval that respects the permissions of the source system, audit logs, usage reporting, and policies such as data-loss prevention — and whether reporting on staff use is scoped and documented.
0 — No admin features documented; accounts are individual sign-ups.
3 — A team workspace with an owner and member invitations, but no SSO, no roles and no audit log.
5 — SSO, admin and member roles, user management, and an admin view of usage.
8 — SAML/OIDC SSO with SCIM provisioning, group-based permissions for models, agents and connectors, retrieval that inherits source-system permissions, exportable audit logs, and usage analytics with documented scope.
10 — Governance a regulated company can operate: fine-grained policies (DLP, content filters, prompt and output logging rules), audit logs streamed to a SIEM, per-agent ownership and approval, usage reporting that can be aggregated or pseudonymised for works-council agreements, and every admin action logged.
The Head of IT
SAML 2.0 including Microsoft Entra ID with session locking, group-based control over which models, hosting regions and features each user group receives, admin approval per connector with employees authenticating to their own accounts so existing source permissions are preserved, append-only audit logs of at least 90 days, and anonymized usage analytics cover most of my rollout checklist. We found no public information on SCIM provisioning, on exporting or streaming logs to a SIEM, or on data-loss-prevention policies — the gaps that matter most at eight hundred seats. 6 7 8 9 11 13
The Data Protection Officer
SAML 2.0 single sign-on including Microsoft Entra ID, organisation-wide enforced two-factor authentication that blocks users until set up, and group permissions deciding models and hosting regions per user group down to EU-only routing. Integrations are released once by admins, staff authenticate with their own accounts so source-system permissions carry over, write actions wait for confirmation by default, and usage analytics are documented as anonymised and non-personal. We found no public information on automated SCIM-style provisioning or on exporting or streaming the audit logs to a SIEM. 6 8 9 11 13
The Automation Lead
SAML 2.0 SSO with Microsoft Entra ID, organization-wide two-factor enforcement that blocks users until setup is complete, group-based control over which models and hosting regions each user group may use, and append-only audit logs kept at least 90 days — most of what I need before agents touch company systems. Connectors are gated by an admin and employees connect their own accounts so source-system permissions carry over, usage analytics is documented as anonymized and non-personal, and a customer-deactivatable privacy filter scrubs personal data before anything reaches a model provider; we found no public information on SCIM provisioning or on streaming audit logs to a SIEM. 6 7 8 11 13
The Customer-Service Director
SAML 2.0 single sign-on including Microsoft Entra ID with session locking, organisation-wide mandatory two-factor authentication enforced at the next login, group permissions deciding which models and hosting regions each user group gets, and append-only audit logs give my IT department genuine control. Connectors keep each employee's own source-system permissions, every integration is enabled once by an admin, and every write waits for confirmation. I found no public information on SCIM provisioning, admin usage analytics or exportable audit logs. 6 8 11 13
The Works Council Member
SAML 2.0 single sign-on with Microsoft Entra ID, organisation-wide two-factor enforcement, group permissions deciding which models and hosting regions each group may use, and append-only audit logs kept at least 90 days give IT genuine control, and usage analytics runs on anonymised, non-personal data with no tracking of individual users — the direction a works council wants. We found no public information on SCIM provisioning, on export of audit logs to a security system, or on admin-side usage reports over individual staff activity. 6 7 8 11 13
The Skeptic
SAML 2.0 single sign-on with Microsoft Entra ID, organization-wide two-factor enforcement that blocks login until setup is complete, per-group control over which models and hosting regions each team may use, append-only audit logs kept at least 90 days, and anonymized usage analytics with no tracking of individual users. Integrations are switched on once by an admin, staff connect with their own accounts so source permissions survive, and every write action waits for confirmation by default. I found no public information on SCIM provisioning or on exporting audit logs to a SIEM. 6 7 8 9 11 13
Integrations, connectors & knowledge
Show reasoningHide reasoning
How this is scored
How the product reaches company knowledge and systems: connectors to file stores, wikis, mail, CRM, ticketing and ERP, how fast and how completely they sync, the API, support for open protocols such as MCP, and how the assistant cites the sources it answers from.
0 — No integrations; users paste text or upload files one at a time.
3 — File upload and one or two connectors (for example a drive), with no API and no statement on sync or citations.
5 — A connector library covering the common file stores, wikis and collaboration tools, answers citing sources, and a documented API.
8 — Connectors to file stores, wikis, mail, CRM and ticketing with incremental sync, custom connectors or MCP support, an API and webhooks for embedding assistants and agents in other tools, and source citations on every grounded answer.
10 — The product sits in the company's systems: read and write connectors with documented scopes, MCP servers and clients, contact-centre or telephony integration where relevant, a knowledge layer that can be audited and corrected, and the data, agents and configuration exportable when the customer leaves.
The Head of IT
A catalog of roughly thirty connectors spans file stores (SharePoint, OneDrive, Box, Egnyte), wikis (Notion, Confluence), mail (Gmail), CRM (HubSpot) and ticketing (Jira), with SharePoint and OneDrive imports kept synchronized, custom MCP servers for internal databases and on-premises software, and a REST API for Spaces. We found no public information on how grounded answers cite their sources, on webhooks for embedding assistants in other tools, or on sync frequency and completeness. 2 13
The Data Protection Officer
Thirty-plus connectors span file stores, wikis, mail, CRM and ticketing with read and write actions, custom MCP servers cover own databases, on-premises software and individual workflows, and a REST API with Spaces knowledge bases of up to 25,000 pages is published, with search via Brave documented as a subprocessor. We found no public information on source citations for grounded answers, on webhooks, or on sync frequency for connectors beyond keeping OneDrive and SharePoint content in sync. 2 6 13
The Automation Lead
The catalog reaches everything my agents touch — Jira and Confluence from search through update, Slack, Gmail, HubSpot, Linear, Asana, the Google and Microsoft drives, Notion — with write actions, and every write waits for the user's confirmation by default, plus custom MCP servers for internal databases and on-premises tools and a REST API for Spaces. What the captured pages do not show is sync detail beyond keeping OneDrive and SharePoint synchronized, webhooks for embedding assistants in other tools, or how answers cite their sources. 2 13
The Customer-Service Director
There is a broad catalogue of thirty-plus connectors with read and write actions — Atlassian Jira and Confluence, HubSpot contacts and tickets, Slack, Google Workspace, Box, SharePoint and OneDrive kept in sync with Spaces — plus custom MCP servers for our own databases and on-premises software and a REST API for Spaces. What I miss for a contact centre: I found no public information on source citations in answers, on webhooks, or on a telephony or contact-centre platform connector. 2 13
The Works Council Member
The connector catalogue covers file stores, wikis, mail, CRM and ticketing — Jira, Confluence, SharePoint, Gmail, HubSpot among dozens — own databases and on-premises software attach via custom MCP servers, and Spaces are reachable through a REST API. Each integration is switched on by an admin once, employees connect their own accounts so existing source permissions carry over, and every write action waits for confirmation by default; we found no public information on webhooks or on citations shown for grounded answers. 2 13
The Skeptic
The connector catalog is genuinely broad — file stores, wikis, Gmail, HubSpot, Jira, Slack, Zoom, Stripe, GitHub and more, plus custom MCP servers for on-premises systems, with Spaces syncing from SharePoint and OneDrive and a documented REST API. What I could not find is any statement that grounded answers cite their sources, nor webhooks or incremental-sync detail. Broad reach into company systems; the provenance of an answer is undocumented. 2 13
Agent capabilities & guardrails
Show reasoningHide reasoning
How this is scored
What an agent can actually do and where it stops: multi-step tasks, tool use and actions in other systems, scheduling and triggers, human approval before consequential actions, run logs, evaluation and testing before release, and the limits the vendor states rather than hides.
0 — No agents; the product is a chat window, whatever the marketing says.
3 — Saved prompts or custom assistants with instructions and files, but no actions in other systems and no run history.
5 — Agents that call tools or APIs and run multi-step tasks, built without code, with a log of each run.
8 — Agents that act in connected systems with scoped permissions, human approval configurable per action, triggers and schedules, test and evaluation tooling before release, and documented limits and failure handling.
10 — Agents a business can put in production and account for: versioning and staged rollout, evaluation against test sets, monitoring of quality and cost per agent, handover to a human with full context, every action attributable to the agent and the person who deployed it, and the vendor's own statement of what agents must not be trusted with.
The Head of IT
Spaces let teams build custom agents from internal data, a web browsing agent exists, and agents act in connected systems with scoped permissions — employees sign in with their own accounts and every write action waits for confirmation by default, which is the guardrail I care most about. We found no public information on run logs for each execution, on triggers and schedules, or on evaluation and testing before release, so accountable production agents are not yet evidenced. 2 13
The Data Protection Officer
Spaces create custom agents on internal data, a web browsing agent is offered, and agents act in connected systems — creating tasks, updating records, sending messages — with every write action waiting for user confirmation by default, admin approval required per integration, and models assignable per published Space. We found no public information on per-run logs, evaluation or test tooling, triggers and schedules, or a vendor statement of what agents must not be trusted with; the terms explicitly exclude the accuracy of the software's evaluations from the contracted services. 2 4 9 13
The Automation Lead
Agents are built without code from internal data (Spaces, up to 25,000 pages, unlimited on Enterprise) with a web browsing agent available, and the guardrail I care most about is in place: every writing action waits for confirmation by default and an admin must approve each integration before anyone connects it. We found no public information on per-agent run logs, triggers or schedules, or evaluation tooling to test an agent before the whole company uses it — platform audit logs exist, but a rehearse-before-rollout story is not documented. 2 6 13
The Customer-Service Director
Spaces create custom agents from internal data, a web browsing agent is included, and agents act through the connectors — finding, creating and updating Jira issues or HubSpot tickets — with every write action waiting for my confirmation by default and admin approval required per integration. But I found no public information on a log of each agent run, triggers or schedules, test and evaluation tooling before go-live, or handover of a conversation to a human with the full context — the last two are make-or-break for putting this in front of my customers. 2 13
The Works Council Member
Spaces let staff build custom agents from internal data, a web browsing agent exists, and agents act in connected systems under admin-approved integrations with — importantly for me — human confirmation before each write by default. We found no public information on per-run histories, triggers or schedules, or test and evaluation tooling, and the terms state that the accuracy of the software's evaluations is explicitly not part of the contracted service. 2 4 13
The Skeptic
Spaces build agents from internal data, a web browsing agent exists, and connectors let agents find, create and update records in Asana, Jira, HubSpot and the rest — under the user's own account permissions, and with every write action waiting for confirmation by default, which is the guardrail I look for. I found no public information on run logs per agent, schedules or triggers, or test-and-evaluation tooling before release. The terms at least state plainly that the accuracy of the software's evaluations is not part of the contract. 2 4 13
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where customer data is hosted, and who the subprocessors are — model providers above all, then hosting, search, telephony and email. Independently sourced by the sovereignty pipeline; for an AI product the model provider is a subprocessor, so a European interface over a non-European model counts as such.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors (including model providers) unnamed.
3 — A privacy policy exists, but hosting location is unstated or non-EU and the model providers behind the product are not named as subprocessors.
5 — EU hosting stated and an EU contracting entity, but prompts reach non-EU model providers or other subprocessors without a stated safeguard or EU region.
8 — EU hosting on named infrastructure, EU contracting entity, every subprocessor listed with its location including model providers, EU inference available, and a DPA offered.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and model processing, every subprocessor European or optional, data export and deletion documented, and a security or certification statement published rather than implied.
The Head of IT
Omnifact GmbH is registered in Frankfurt (HRB 131357), all customer data is processed in Microsoft Azure region Germany West Central with backups staying in Frankfurt, the subcontractor list names model providers with locations and data processing agreements (Microsoft Germany, Mistral AI in Paris, Anthropic, Google Cloud EMEA serving EU-hosted Gemini and Anthropic), and a DPA plus ISO 27001:2022 certification are published at a trust center. Third-country processing is covered by Standard Contractual Clauses and prompts can be anonymized in Germany before reaching a provider, though non-European providers remain in the chain and we found no public information on ownership or parent company. 3 4 5 6 7
The Data Protection Officer
The contracting entity is Omnifact GmbH of Frankfurt under German law with Frankfurt jurisdiction, all customer data and backups sit in Microsoft Azure Germany West Central with the privacy filter also running in Frankfurt, and subprocessors are listed with locations: Mistral AI in Paris, Microsoft Germany in Munich, Google Cloud EMEA in Dublin hosting Gemini and Anthropic in region europe-west, Anthropic PBC, Stripe Payments Europe, SendGrid, Brave and optional scheduling tools. EU inference and a mandatory DPA are in place. We found no public information on ownership or a parent company, US-based services such as Brave and SendGrid sit in the chain rather than being optional, and the terms state model providers' technical reasons may require non-EEA servers — so I stop short of calling this sovereign end to end. 3 4 5 6 7
The Automation Lead
The contracting entity is Omnifact GmbH in Frankfurt (HRB 131357, German law, Frankfurt venue), customer data is hosted in Microsoft Azure Germany West Central with backups staying in Frankfurt, and the subprocessor list names the model providers with locations — Microsoft Germany in Munich, Mistral in Paris, Google Cloud EMEA in Dublin serving Gemini and Anthropic from europe-west — alongside Anthropic, Twilio and Stripe, with a DPA offered and ISO 27001 certified. The terms still permit USA server locations when a model provider's technical reasons require it, and we found no public information on the company's ownership. 3 4 6 7
The Customer-Service Director
Omnifact GmbH is registered at the Frankfurt local court, all customer data and backups sit in Azure Germany West Central in Frankfurt, and the subprocessor list names locations including Mistral AI in Paris, Microsoft Germany in Munich and Google Cloud EMEA in Dublin hosting Gemini and Anthropic models in region europe-west, with a mandatory Article 28 DPA under German law and ISO 27001 certification published. Ownership is not documented on the captured pages, and model providers such as OpenAI and Anthropic are US companies, though customers can deactivate providers and EU-hosted routing exists. 3 6 7
The Works Council Member
The contracting entity is Omnifact GmbH in Frankfurt under German law, all customer data is processed in Azure Germany West Central with backups staying in Frankfurt, and the subprocessor list names Microsoft Germany in Munich, Mistral in Paris, Google Cloud EMEA in Dublin and Stripe Payments Europe with data processing agreements — model providers are treated as subprocessors, which is how it should be. Non-European providers such as Anthropic, Brave and Twilio Sendgrid remain on the list under standard contractual clauses, and the terms say US server locations may be needed for model providers, so this is strong but not sovereign end to end. 3 4 5 6 7
The Skeptic
The contracting entity is Omnifact GmbH, Hansaallee 154, Frankfurt, registered at the local court under HRB 131357, under German law with exclusive jurisdiction in Frankfurt; all customer data is processed in Microsoft Azure Germany West Central with backups remaining in Frankfurt; the DPA lists subprocessors with addresses and data processing agreements — Microsoft Germany in Munich, Mistral AI in Paris, Google Cloud EMEA hosting Gemini and Anthropic models in europe-west, Anthropic, Brave, Stripe Payments Europe, Twilio SendGrid — and an ISO/IEC 27001:2022 certificate has existed since April 2026. The catch my kind always finds: OpenAI, Anthropic, Google and Microsoft are US companies behind the European interface, and the terms state that LLM providers' technical reasons may require USA server locations, covered by standard contractual clauses. Customers can deactivate any provider per organization, but ownership of Omnifact itself is not documented on the captured pages. 3 4 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a company can compute the real annual cost from public pages alone: price per seat, per agent, per conversation or per usage unit, what is included in each tier, usage limits and overage, which models, connectors or agents cost extra, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or "from" figure exists, but usage limits, included models and what scales the cost are unclear.
5 — Prices per tier are public with the main inclusions, but usage limits, overage, agent runs or enterprise features (SSO, audit logs, EU processing) are unpriced or "on request".
8 — Every tier priced publicly with seat or usage units, usage limits and overage rates, add-ons listed, minimum seats and term stated.
10 — Complete price computability: annual cost derivable for a given number of seats, agents or conversations, with every usage rate, model surcharge, add-on and support tier and the cancellation and data-return terms published.
The Head of IT
The Pro plan is public at €25 per user per month (paid annually) for teams of up to 50 users, including €5 per user per month in pooled AI credits for premium models, with monthly and annual terms, notice periods, payment terms and annual price-adjustment rules published. Enterprise — the only tier without the 50-user cap, and where SSO, on-premise hosting and custom usage credits sit — is custom-priced on request, so the real annual cost for eight hundred staff cannot be derived from the public pages. 2 4
The Data Protection Officer
The Pro tier is public at €25 per user per month (paid annually) for teams up to 50 users with a 16% annual discount, €5 per user per month in pooled premium-model credits that expire monthly, unlimited base-tier models once credits run out, and terms, VAT treatment, payment periods and adjustment rights published. Enterprise — where single sign-on, on-premises hosting and self-hosted models sit — is priced only as "Custom", and we found no public information on rates for additional usage credits or premium model surcharges, so the real annual cost is computable only for the small-team tier. 2 4
The Automation Lead
The Pro plan is public at €25 per user per month paid annually for teams up to 50, with €5 per user per month in pooled AI credits for premium models that expire monthly while base-tier access stays unlimited, a 25,000-page knowledge-base limit, a 10-day trial, and clean contract terms (monthly terminable anytime, three months' notice on annual, 14-day payment, VAT on top). The Enterprise tier — where SSO, on-premise hosting and self-hosted models live — is priced only on request and topping up premium credits beyond the pooled allowance is custom, so a larger organization cannot compute its real annual cost from public pages. 2 4
The Customer-Service Director
The Pro plan is published at €25 per user per month paid annually for teams of up to 50 users, with €5 per user per month in pooled credits for premium models whose monthly expiry and the unlimited base-tier fallback are explained, and trial, billing cycle, auto-renewal and price-adjustment terms are in the terms of service. But the Enterprise tier — where single sign-on, on-premises hosting and self-hosted models sit — carries only "Custom Flexible Terms Available", and I found no published overage rate for extra credits nor any price per conversation my CFO could forecast against call volumes. 2 4
The Works Council Member
The Pro plan is published at €25 per user per month paid annually for teams up to 50 users, with €5 per user per month in pooled AI credits for premium models that expire monthly, a 10-day trial without credit card, and public contract terms including auto-renewal, annual price adjustment and a termination right on increases over 10%. The Enterprise tier is custom-priced on request, and we found no public information on the monthly Pro rate or on what premium usage beyond the pooled credits costs, so a real annual total is not computable from public pages alone. 2 4
The Skeptic
The Pro plan is public and unusually precise: €25 per user per month paid annually with a stated 16% annual discount, teams of up to 50 users, €5 per user per month in pooled premium-model credits that expire monthly — after which unlimited base-tier models remain — plus a 10-day trial with no credit card required, invoice and SEPA payment, and a 14-day payment period with VAT added. Enterprise, where single sign-on, on-premises hosting and self-hosted LLMs live, is "Custom", and I found no public overage rates or minimum seats, so the cost of a thousand seats is a sales call — and the terms permit annual price adjustments after 12 months. 2 4
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Omnifact
Is Omnifact European?
Yes. whats-best.ai classifies Omnifact as EU-Made.
Where does Omnifact store data?
The default storage location for customer data is not stated on the vendor’s pages as of 26 Oct 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 26 Oct 2026.
Does Omnifact have a free plan?
Not stated on the vendor’s pages as of 26 Oct 2026.
What are the best alternatives to Omnifact?
As of 28 Oct 2026, the panel rates Langdock (4/5), Dust (3.5/5) and Unique AI (3.5/5) highest among the other 15 AI Agents & Assistants products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Langdock (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Omnifact alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 26 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage omnifact.ai Checked 26 Oct 2026 Details →
- 2 Pricing page omnifact.ai Checked 26 Oct 2026 Details →
- 3 Legal notice omnifact.ai Checked 26 Oct 2026 Details →
- 4 Terms of service omnifact.ai Checked 26 Oct 2026 Details →
- 5 Privacy policy omnifact.ai Checked 26 Oct 2026 Details →
- 6 Data use, training & retention — found from sitemap omnifact.ai Checked 26 Oct 2026 Details →
- 7 Data use, training & retention — found from sitemap omnifact.ai Checked 26 Oct 2026 Details →
- 8 Models & processing location — found from sitemap omnifact.ai Checked 26 Oct 2026 Details →
- 9 Models & processing location — found from sitemap docs.omnifact.ai Checked 26 Oct 2026 Details →
- 10 Admin, identity & access controls — found from sitemap docs.omnifact.ai Checked 26 Oct 2026 Details →
- 11 Admin, identity & access controls — found from sitemap docs.omnifact.ai Checked 26 Oct 2026 Details →
- 12 Integrations, connectors & knowledge — found from sitemap omnifact.ai Checked 26 Oct 2026 Details →
- 13 Integrations, connectors & knowledge — found from sitemap omnifact.ai Checked 26 Oct 2026 Details →