# Omnifact — AI Agents & Assistants

Omnifact by Omnifact GmbH holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-10-28. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Omnifact GmbH (https://omnifact.ai)
- Category: [AI Agents & Assistants](https://whats-best.ai/software/ai-agents.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/ai-agents/omnifact
- Alternatives: https://whats-best.ai/software/ai-agents/omnifact/alternatives ([markdown](https://whats-best.ai/software/ai-agents/omnifact/alternatives.md))
- Data as of: 2026-10-29 · evaluated 2026-10-28 · oldest source captured 2026-10-26

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Omnifact GmbH
- Headquarters: Not stated on the vendor’s pages as of 26 Oct 2026
- Data hosting: Default not stated; pages mention Germany [S7]
- Free plan: Not stated on the vendor’s pages as of 26 Oct 2026

## The panel's verdict

Omnifact is an AI assistant and agent platform from Omnifact GmbH, aimed at the public sector and regulated industries. Sovereignty scores cluster at 8: a German-law contract with Frankfurt jurisdiction, customer data processed in Microsoft Azure Germany West Central with backups staying in Frankfurt, a mandatory Article 28 data processing agreement, named subprocessors, and an ISO/IEC 27001:2022 certificate. Processing and models as well as admin and access score 7 to 8, with providers deactivatable per organization and per space, per-group EU-only routing, SAML 2.0 sign-on and append-only audit logs kept at least 90 days. The weakest areas are data use and training and agent capabilities, both at 4 to 6: judges found no public statement on whether prompts, files or outputs train any model, and none on agent run logs, triggers, schedules or evaluation tooling, while the terms exclude the accuracy of the software's evaluations from the contracted services. Pricing transparency sits at 5 to 6, with the Pro plan public at €25 per user per month paid annually for teams up to 50 users and Enterprise priced only on request.

**Speaks for it:**
- Customer data is processed in Microsoft Azure Germany West Central (Frankfurt) with backups remaining in Frankfurt, under German law with Frankfurt jurisdiction.
- Model providers are named — Azure OpenAI, OpenAI, Anthropic, Google, Mistral AI and custom providers — and can be deactivated per organization and per space, with bring-your-own-key, self-hosted models and on-premises deployment documented.
- SAML 2.0 single sign-on with Microsoft Entra ID, organization-wide enforced two-factor authentication, and append-only audit logs kept at least 90 days.
- A mandatory Article 28 data processing agreement is concluded at registration, retention is configurable by the administrator, and a privacy filter strips personal data from prompts before they reach a model provider.
- Every write action waits for user confirmation by default, integrations require admin approval, and staff connect their own accounts so source permissions carry over.

**Held against it:**
- We found no public statement on whether prompts, files or outputs are used to train any model, the vendor's or a provider's.
- We found no public information on per-agent run logs, triggers or schedules, or on test-and-evaluation tooling before release, and the terms explicitly exclude the accuracy of the software's evaluations from the contracted services.
- The Enterprise tier — where single sign-on, on-premises hosting and self-hosted models sit — is priced only as custom, and we found no published overage rate for premium-model credits beyond the pooled monthly allowance.
- The terms state that LLM providers' technical reasons may require server locations in the USA or outside the EEA, and US-based services such as Brave and SendGrid remain in the subprocessor chain.
- We found no public information on source citations for grounded answers, on webhooks, or on SCIM provisioning and SIEM export of audit logs.

**Best for:**
- You are a public-sector or regulated-industry team in Europe that needs EU-based hosting of platform data, a German-law contract and a mandatory Article 28 DPA.
- You want admin control over which models and hosting regions each user group may use, including EU-only routing and per-provider deactivation.
- You run a team of up to 50 users and want a published price — €25 per user per month paid annually — with a 10-day trial and no credit card required.
- You want agents that act in tools such as Jira, Confluence and HubSpot while every write waits for confirmation.

**Avoid if:**
- Your procurement requires model inference to remain within the EEA in every case, since the terms reserve USA or non-EEA server locations when a provider's technical reasons require them.
- You need a contractual guarantee on the accuracy of AI outputs, which the terms explicitly exclude from the contracted services.
- You must budget a deployment above 50 users from public prices, since Enterprise is priced only on request.
- You depend on support during evaluation, since the terms state that no maintenance or support obligations apply to the trial version.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Head of IT | The Data Protection Officer | The Automation Lead | The Customer-Service Director | The Works Council Member | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Data use, training & retention | 2/5 | 3/5 | 3/5 | 2/5 | 2/5 | 2.5/5 |
| Models & processing location | 3.5/5 | 4/5 | 4/5 | 3.5/5 | 4/5 | 3.5/5 |
| Admin, identity & access controls | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Integrations, connectors & knowledge | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Agent capabilities & guardrails | 3/5 | 3/5 | 3/5 | 2/5 | 2/5 | 3/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3/5** | **3/5** | **3.5/5** |

### The judges

- **The Head of IT** (v1.0): Has to roll an AI assistant out to eight hundred staff without a second shadow-IT wave. Wants SSO and SCIM, groups that decide who gets which model, agent and connector, answers that respect SharePoint permissions, audit logs for the SIEM, and a deployment option that is not "trust us".
- **The Data Protection Officer** (v1.0): Signs the DPA and gets asked where a prompt goes. Wants every model provider named as a subprocessor with its region, training excluded for all of them, retention the company controls, and an EU-only switch that also covers agents and connectors — not just the chat window.
- **The Automation Lead** (v1.0): Builds the agents that file tickets, draft offers and chase approvals across the ERP, CRM and wiki. Wants tools and actions with scoped permissions, MCP and an API, approval steps before anything is sent, run logs, and a way to test an agent before the whole company uses it.
- **The Customer-Service Director** (v1.0): Runs a contact centre with forty agents and wants half the routine calls and chats answered by an AI agent. Wants handover to a human with the full context, actions in the order and ticket systems, evaluation before go-live, and a price per conversation the CFO can forecast.
- **The Works Council Member** (v1.0): Has a co-determination right the moment a tool can monitor staff, and an AI assistant logs every prompt. Wants usage reports that can be aggregated or pseudonymised, prompt logging rules set out in writing, a human approving what agents do to colleagues, and no training on staff input.
- **The Skeptic** (v1.0): Has read "European AI" on a wrapper that sends every prompt to a US model, "agents" that are saved prompts, and "we never train on your data" with no word on the model provider behind it. Asks which model answers, where it runs, what it may do unsupervised, and what a thousand seats cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AI no warranty: no [S4]
- Audit rights: nach Absprache · yes [S7]
- Audit rights: yes [S6]
- Breach notification: 24 [S7]
- Breach notification hours: 24 [S6]
- Data residency: yes · yes [S7]
- Developers no prod access: yes [S6]
- DPA art28: yes [S4]
- DPA available: yes [S2]
- DPA available: yes [S5]
- Dsr contact: privacy@omnifact.ai [S5]
- Encryption at rest: AES-256 [S6]
- Encryption in transit: HTTPS/TLS [S6]
- Encryption tls: yes [S7]
- EU eea processing: EU/EEA · yes [S6]
- GDPR: yes · yes [S3]
- GDPR: yes [S2]
- GDPR: yes · yes [S5]
- GDPR: yes [S8]
- GDPR: yes [S4]
- GDPR: yes [S13]
- GDPR footer: yes · yes [S4]
- ISO 27001: yes [S3]
- ISO 27001: yes [S5]
- ISO 27001: yes [S8]
- ISO 27001: yes [S4]
- ISO 27001: 2026-04-14 · ISO/IEC 27001:2022 · yes [S7]
- ISO 27001 certified: ISO/IEC 27001:2022 · 2026-04-14 [S6]
- ISO 27001: yes [S2]
- ISO 27001: yes [S13]
- Llm providers: Mistral AI · OpenAI · Microsoft · Anthropic · Google [S4]
- MFA mandatory: yes [S6]
- No test with customer data: no [S6]

**Data**
- Account retention: 6 · 12 [S5]
- Audit log retention: 90 · yes [S7]
- Audit log retention days: yes · 90 [S6]
- Backup pitr: 2 · 5 · 30 [S7]
- Backup retention: 2 · 5 · 30 [S6]
- Billing retention: 6 · 10 [S5]
- Data subject request SLA days: 7 [S6]
- Deletion implemented: yes [S6]
- Deletion on request: support@omnifact.ai · 30 [S6]
- Deletion org: support@omnifact.ai · 30 [S7]
- Encryption at rest: AES-256 [S7]
- Log retention: 30 [S5]
- No automated decision making: no · no [S5]
- No customer data testing: no [S7]
- Residency EU: EU [S13]
- Retention configurable: yes [S7]
- Third party disclosure prohibited: yes [S4]

**Hosting**
- Azure region: Germany West Central (Frankfurt) · Microsoft Azure [S6]
- Backups in EU: EU (Frankfurt) [S6]
- Deployment options: managed · own cloud · on-premise [S5]
- Deployment options: managed · own cloud · on-premise [S8]
- Deployment options: managed · own cloud · on-premise [S4]
- Deployment options: managed · own cloud · on-premise [S13]
- EU data residency: EU [S2]
- Germany: Frankfurt · Germany [S3]
- Germany: Germany [S2]
- Germany: Frankfurt · Germany [S5]
- Germany: Frankfurt · Germany [S4]
- Germany: Germany [S13]
- Llm EU preference: EEA · yes [S4]
- Location: Frankfurt · Germany · yes [S8]
- Region: Germany West Central (Frankfurt) · Microsoft Azure [S7]
- Website provider: USA · Netlify, Inc. [S5]

**Integrations**
- Airtable: Airtable [S13]
- Asana: Asana [S13]
- Atlassian: Jira · Confluence · Atlassian [S13]
- Box: Box [S13]
- Canva: Canva [S13]
- Clickup: ClickUp [S13]
- Custom mcp: yes [S13]
- Custom mcp details: own databases · on-premises software · custom workflows [S13]
- Egnyte: Egnyte [S13]
- Github: GitHub [S13]
- Gitlab: GitLab [S13]
- Gmail: Google [S13]
- Google calendar: Google [S13]
- Google chat: Google [S13]
- Google docs: Google [S13]
- Google drive: Google [S13]
- Google sheets: Google [S13]
- Google slides: Google [S13]
- Hubspot: HubSpot [S13]
- Linear: Linear [S13]
- Llm providers toggleable: LLM providers activatable/deactivatable per organization (and per space) by customer [S6]
- Lucid: Lucid Software [S13]
- Miro: Miro · read · add content [S13]
- Neon: Neon [S13]
- Notion: Notion [S13]
- Onedrive business: Microsoft · import and sync files into Spaces [S13]
- Onedrive personal: personal OneDrive accounts · Microsoft [S13]
- Paypal: PayPal · lookup only [S13]
- Posthog: PostHog [S13]
- Self hosted llm: yes [S4]
- Sentry: Sentry [S13]
- Sharepoint: Microsoft · import and sync SharePoint documents into Spaces [S13]
- Slack: Slack · search · read threads · send messages [S13]

**Legal**
- Applicable law: German law, CISG excluded [S4]
- B2b only: yes [S4]
- Change notification: 2 · 6 [S4]
- Confidentiality period: 5 [S4]
- Controller: Hansaallee 154, 60320 Frankfurt am Main · Omnifact GmbH [S5]
- DPA: yes [S8]
- DPA available: yes [S3]
- DPA available: yes [S13]
- DPA conclusion method: yes [S6]
- DPA effective date: 2026-04-21 [S6]
- DPA entity: processor · Hansaallee 154, 60320 Frankfurt, Germany · Omnifact GmbH [S6]
- DPA governing law: German law · Frankfurt am Main [S6]
- DPA language: German [S6]
- DPA mandatory: yes [S4]
- DPA version: Stand: 21. April 2026 [S7]
- Effective date: 2024-08-01 [S4]
- Entity: Omnifact GmbH [S2]
- Entity: Omnifact GmbH [S8]
- Entity: Omnifact GmbH · Hansaallee 154, 60320 Frankfurt, Germany [S4]
- Entity: Omnifact GmbH · Hansaallee 154, 60320 Frankfurt, Deutschland [S7]
- Entity: Omnifact GmbH [S13]
- Entity name: Omnifact GmbH · Hansaallee 154, 60320 Frankfurt, Germany [S3]
- German version controlling: German version of ToS is legally decisive; English is a translation [S4]
- Jurisdiction: deutsches Recht · Frankfurt am Main [S7]
- Register details: Local court Frankfurt am Main · HRB 131357 [S3]
- Subcontractors allowed: yes [S4]
- Term renewal: yes · 3 · yes [S4]
- Termination form: yes [S4]
- VAT id: DE363310518 [S3]

**Pricing**
- Adjustment termination right: yes [S4]
- Annual adjustment: 3 · 12 · yes [S4]
- Annual discount: 16 [S2]
- Billing cycles: monthly · annual [S4]
- Credits footnote: yes · no · yes [S2]
- Enterprise inherits pro: unlimited · yes [S2]
- Enterprise price: yes · yes [S2]
- Payment methods: yes [S2]
- Payment period: 14 [S4]
- Per user fee scaling: yes [S4]
- Pro price: EUR · annual · 25 [S2]
- Pro team limit: 50 [S2]
- SLA availability: network availability excluding planned maintenance and force majeure · annual average · 99.5 [S4]
- Trial: 10 · 50 [S2]
- Trial no credit card: no [S2]
- Unified billing: yes [S2]
- VAT: prices subject to statutory VAT · no [S4]

**Product**
- 2FA enforcement behavior: Users without 2FA are prompted to set it up at next login and cannot access the platform until setup is complete [S11]
- 2FA org enforcement: Admins can require 2FA for all team members organization-wide [S11]
- Academy certification: EU AI Act literacy requirements · yes [S2]
- Azure openai hosting: Azure-hosted models offering enterprise-level security and performance [S9]
- Base tier models: unlimited [S2]
- Bring your own API key: yes [S2]
- Custom model integration: Chat · Spaces · yes [S8]
- Custom SLA: yes [S2]
- Custom usage credits: yes [S2]
- Customer llm selection: yes [S4]
- Delivery model: SaaS with storage for customer data [S4]
- Demo call: 30 [S2]
- Deployment options: yes · yes · yes [S3]
- Deployment options: managed · eigene Cloud · on-premise [S7]
- Deployment options: managed · own cloud · on-premise [S6]
- Document chat: yes [S2]
- Enterprise model control: yes [S8]
- Enterprise network allowlist: Documentation covers required hostnames, ports and proxy settings (WebSocket exceptions, TLS inspection) for corporate firewalls/proxies [S10]
- Enterprise SSO: yes [S2]
- EU hosted models: yes [S2]
- Granular access control: base · standard · premium · EU-only · yes [S8]
- Image generation: yes [S2]
- Image generation prereq: Image generation must first be enabled for the team via group management [S9]
- Image model management: Image generation models are managed on the Models page with a default model selectable [S9]
- Image models google: Google image models: Nano Banana 2, Nano Banana Pro, Nano Banana [S9]
- Image models openai: OpenAI image models: GPT-Image-2, GPT-Image-1.5, GPT-Image-1, GPT-Image-1 Mini [S9]
- Integration model: yes · yes · yes [S13]
- ISO badge footer: yes [S6]
- Login throttling: Login throttling exists; exact lockout thresholds and timeout durations are not published [S10]
- Mandatory 2FA: Organization-wide mandatory 2FA can be enforced [S10]
- Model effect disabled: Disabled models appear in no model dropdowns and cannot be used by the team [S9]
- Model effect enabled: Enabled models are selectable in chat and assignable to Published Spaces [S9]

**Subprocessors**
- Anthropic: Anthropic PBC · yes [S6]
- Brave search: Brave Software, Inc. · web search via Brave Search API · yes [S6]
- Calendly: Calendly · appointment scheduling · yes · Calendly LLC [S5]
- Google tag manager: Google Tag Manager · ads conversion tracking · Google Ireland Limited · yes [S5]
- Google vertex AI EU: Google Cloud EMEA Limited (Vertex AI) · europe-west · Gemini · Anthropic models [S6]
- Hubspot: HubSpot · CRM and scheduling [S5]
- Llm toggle: yes [S7]
- Microsoft: Microsoft Germany GmbH · Munich · yes [S6]
- Mistral: Mistral AI · Paris, France · yes [S6]
- Notification period: 30 · yes [S7]
- Plausible: Plausible Analytics · Estonia · analytics · Plausible Insights OÜ [S5]
- Stripe: Stripe Payments Europe, Limited · payment processing · yes [S6]
- Twilio: Twilio · email dispatch and newsletter [S5]
- Twilio sendgrid: Twilio Inc. (Sendgrid) · e-mail dispatch · yes [S6]
- Zapier: Zapier · appointment scheduling [S5]

**Support**
- Dedicated team: yes [S2]
- Onboarding docs: yes [S2]
- Pro email SLA: email · 24 [S2]
- Support teams: German · US · email (24h) · dedicated team · 24 [S2]

58 more facts on the canonical page: https://whats-best.ai/software/ai-agents/omnifact

## Questions

### Is Omnifact European?

Yes. whats-best.ai classifies Omnifact as EU-Made.

### Where does Omnifact store data?

The default storage location for customer data is not stated on the vendor’s pages as of 26 Oct 2026. The vendor’s pages mention Germany as hosting location, per [the vendor’s page captured 26 Oct 2026](https://whats-best.ai/evidence/10909).

### Does Omnifact have a free plan?

Not stated on the vendor’s pages as of 26 Oct 2026.

### What are the best alternatives to Omnifact?

As of 28 Oct 2026, the panel rates [Langdock (4/5)](https://whats-best.ai/software/ai-agents/langdock), [Dust (3.5/5)](https://whats-best.ai/software/ai-agents/dust) and [Unique AI (3.5/5)](https://whats-best.ai/software/ai-agents/unique-ai) highest among the other 15 AI Agents & Assistants products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Langdock](https://whats-best.ai/software/ai-agents/langdock) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Omnifact alternatives](https://whats-best.ai/software/ai-agents/omnifact/alternatives).

## What this page leaves out

- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://omnifact.ai/ (checked 2026-10-26)
- [S2] Pricing page: https://omnifact.ai/pricing (checked 2026-10-26)
- [S3] Legal notice: https://omnifact.ai/legal-notice (checked 2026-10-26)
- [S4] Terms of service: https://omnifact.ai/terms (checked 2026-10-26)
- [S5] Privacy policy: https://omnifact.ai/privacy (checked 2026-10-26)
- [S6] Data use, training & retention — found from sitemap: https://omnifact.ai/dpa (checked 2026-10-26)
- [S7] Data use, training & retention — found from sitemap: https://omnifact.ai/de/dpa (checked 2026-10-26)
- [S8] Models & processing location — found from sitemap: https://omnifact.ai/models (checked 2026-10-26)
- [S9] Models & processing location — found from sitemap: https://docs.omnifact.ai/de/platform/team-administration/models (checked 2026-10-26)
- [S10] Admin, identity & access controls — found from sitemap: https://docs.omnifact.ai/de/platform/team-administration/security-and-access (checked 2026-10-26)
- [S11] Admin, identity & access controls — found from sitemap: https://docs.omnifact.ai/en/platform/team-administration/security-and-access (checked 2026-10-26)
- [S12] Integrations, connectors & knowledge — found from sitemap: https://omnifact.ai/integrations/catalog (checked 2026-10-26)
- [S13] Integrations, connectors & knowledge — found from sitemap: https://omnifact.ai/de/integrations/catalog (checked 2026-10-26)

---

Cite as: whats-best.ai, "Omnifact — AI Agents & Assistants", AI panel analysis, as of 2026-10-29. https://whats-best.ai/software/ai-agents/omnifact

Corrections: https://whats-best.ai/correct/1031?target=page