Omnifact
Omnifact is a German enterprise AI platform combining multi-model chat with document-grounded assistants. Its Privacy Filter masks sensitive data before prompts reach OpenAI, Anthropic, Google or Mistral, with hosting in Frankfurt and optional on-premise deployment.
What is Omnifact?
Omnifact is an enterprise generative-AI platform published by Omnifact GmbH of Frankfurt am Main and delivered as software-as-a-service at chat.omnifact.ai. It is built around two products. Chat is a conversational workspace where staff talk to large language models from OpenAI, Anthropic, Google and Mistral, choosing a model per conversation across Base, Standard and Premium tiers. Spaces is a corporate retrieval-augmented-generation layer that turns internal documents and connected sources into interrogable assistants, personal or shared across a team.
What distinguishes the platform is the Privacy Filter, and it is documented rather than merely asserted. An ensemble of a purpose-trained small language model for named-entity recognition and rule-based regular expressions detects people, companies, addresses, emails, phone numbers and IBANs. Detected entities are swapped for placeholder tokens before the prompt reaches the model provider, and the real values are restored in the answer. Filtering happens entirely inside the platform on Azure infrastructure in Germany West Central, Frankfurt. Authorised users can selectively unmask through Click to Reveal, or exclude text from filtering with a double-percent syntax.
Around this sit the features a regulated organisation asks for: chat with uploaded documents, a web browsing agent, image generation, multilingual queries, connected sources from Google Drive, OneDrive and SharePoint, enterprise single sign-on, SCIM group synchronisation, two-factor authentication, model allow-lists, per-user quotas and budgets, and usage analytics. Developers get an OpenAI-compatible API gateway, a team API key, API access to published Spaces and a public OpenAPI specification.
Deployment is deliberately flexible: managed SaaS, the customer's own cloud (IONOS and Open Telekom Cloud are named), or fully on-premise, with an air-gapped option mentioned for high-security environments. Self-hosted models and bring-your-own API keys are supported on the Enterprise plan.
Use is strictly business-to-business — the terms reserve the service to entrepreneurs under German law and to public-law entities. The customer base shown on the homepage reflects that: Aareal Bank, Finanzagentur, Ruhrbahn, HAW Hamburg, Gewoba, Kulzer, Sport-Thieme and several German municipalities.
What it does
- Question internal company documents in plain language through retrieval-augmented Spaces
- Mask personal data and company identifiers automatically before any prompt leaves the platform
- Switch between OpenAI, Anthropic, Google and Mistral models from one interface
- Build specialised AI assistants per team, department or project
- Summarise, compare and extract insight from uploaded documents
- Search the live web from inside a conversation and generate images
- Govern AI usage with quotas, budgets, model allow-lists and interaction logging
When to use Omnifact / When not to
A quick filter to help you decide if Omnifact is the right fit.
When to use Omnifact
- Banks, insurers and financial institutions that must keep customer data inside a controlled environment
- Public authorities and municipalities digitising internal processes under GDPR
- Hospitals, care providers and health administrations handling sensitive records
- IT, security and data-protection leads asked to replace shadow IT with a governed AI platform
- Compliance, legal and regulatory teams searching internal policies and documentation
When not to use Omnifact
- Individuals and freelancers: the terms restrict registration to legal entities and entrepreneurs
- Teams looking for a permanent free tier, since only a 10-day trial is offered
- Organisations above 50 users that do not want to move to the quote-only Enterprise plan
- Buyers who need single sign-on, on-premise hosting or Spaces API access on an entry-level budget
- Users who expect a native iOS or Android application rather than a mobile web app
How to use Omnifact
A typical end-to-end flow, from setup to results.
- Create a team account at chat.omnifact.ai with no credit card required
- Start the 10-day trial, remembering that registration is open only to a legal entity acting through an authorised representative
- Follow the quickstart in the public documentation, announced as a five-minute path
- Type requests in everyday language in the chat and pick a model per conversation with the LLM selector
- Attach documents to a conversation to summarise them or extract specific information
- Create personal or team Spaces and upload the files that should ground the assistant's answers
- Connect Google Drive, OneDrive or SharePoint so that Spaces index those sources automatically
- Share Spaces with colleagues and set roles and permissions for each
- As an administrator, configure the team-wide Privacy Filter, enable models, manage groups and SCIM, enforce two-factor authentication and set retention
- Move to the full version through sales@omnifact.ai or by changing plan in the team administration
Pros & Cons
Pros
- Data residency in Germany on Azure Germany West Central, with EU-hosted model options
- Complete and mutually consistent legal set: legal notice, privacy policy, terms and an Article 28 DPA naming every sub-processor
- Explicit no-training policy on customer data, stated in the product documentation
- Genuine vendor independence: several model providers, bring-your-own API key and self-hosted models
- The Privacy Filter is described technically, not just advertised, down to its detection methods
- ISO 27001 claimed and audited, with annual external penetration tests and annual recovery testing
- Named public-sector and regulated customers, a transparent Pro price and a trial without a credit card
Cons
- Business-only: the terms exclude private individuals entirely
- No permanent free plan; the only free access is a 10-day trial
- Single sign-on, on-premise hosting, Spaces API access, usage analytics and self-hosted models are all Enterprise-only, at an undisclosed price
- The Pro plan caps out at 50 users and a 5,000-page knowledge base
- Premium model credits are limited to EUR 5 per user per month and expire monthly without carry-over
- The published availability commitment differs between documents: 99.5% in the terms, 99.9% in the DPA
- Only the German version of the terms is legally binding, and the Trust Center returns no readable content
Pricing & Plans
There is no permanent free plan. Access begins with a 10-day free trial that requires no credit card. The lowest published price point is EUR 25 per user per month on the Pro plan when billed annually, annual billing being 16% cheaper than monthly. The Enterprise plan is quoted individually. All prices are stated exclusive of applicable value added tax, and Omnifact reserves the right to adjust remuneration annually.
- full platform including Chat and Spaces
- EUR 5 of premium model credits per user per month
- unlimited base-tier models
- Privacy Filter
- up to 50 users
- up to 5
- 000 pages of Spaces knowledge base
- email support within 24 hours
- everything in Pro plus unlimited team size
- custom model credits
- self-hosted LLMs and bring-your-own API key
- usage analytics
- API access to Spaces
- enterprise single sign-on
- custom SLAs
- on-premise deployment
- individual training courses
- strategy workshops and certification options
Data, GDPR & hosting
A consolidated view of how Omnifact handles your data.
GDPR overview
GDPR compliance is claimed explicitly and repeatedly, and the supporting paperwork is unusually complete for a tool of this size. Omnifact publishes a legal notice, a privacy policy dated 22 June 2026, terms of service and a full Article 28 Data Processing Agreement whose signature conditions the contract. An external Data Protection Officer is named (Wolfgang Thanner, securiserve), data-protection requests go to privacy@omnifact.ai, and the eight data-subject rights are listed individually. Annex 4 of the DPA names every approved sub-processor with its address. Being established in Frankfurt, the company needs no Article 27 representative. Omnifact also flags its own reservations: several sub-processors are US-headquartered, and Groq is offered without a compliant DPA, activated at the customer's own risk.
Who owns the data?
The customer remains the data controller and Omnifact GmbH acts as processor under Article 28 GDPR; signing the published Data Processing Agreement is a precondition of the contract. The customer owns and is responsible for everything uploaded, and Omnifact states it performs no check on the completeness, plausibility or content of that material. The terms expressly forbid Omnifact from transferring or disclosing customer data sets to third parties, beyond the confidentiality regime already in force. Software source code is excluded from the contract unless separately agreed. For the marketing site and account registration, Omnifact GmbH in Frankfurt am Main is itself the controller.
Reuse rights
Customers keep full reuse rights over their own content: nothing in the terms transfers ownership or grants Omnifact a licence to exploit uploaded material, and outputs are used freely within the customer's own business activity. The reciprocal limits are on Omnifact, which may not pass data sets to third parties. Two qualifications matter. First, prompts are forwarded to the selected large-language-model provider once the Privacy Filter has masked detected entities, and the customer explicitly consents to that transmission. Second, the right to use the software itself is non-transferable, non-sublicensable and limited to the contracted number of users within the customer's own staff. Documentation states that customer data is never used to train models.
Data retention & training
Hosting summary
The platform runs on Microsoft Azure in the Germany West Central region, in Frankfurt, and the site advertises EU data residency throughout. The production database is an Azure PostgreSQL Flexible Server with zone-redundant high availability. Privacy Filter processing happens entirely inside that German environment, so sensitive data is masked before it leaves the controlled perimeter. EU-hosted models are available, with Gemini and Anthropic served through Google Vertex AI in the europe-west region. Customers may instead deploy in their own cloud — IONOS and Open Telekom Cloud are named — or fully on-premise, with an air-gapped option mentioned for high-security environments. Two caveats: the marketing website itself is hosted by Netlify in the United States, separately from the platform, and the terms reserve the case where a model provider's technical constraints require servers outside the European Economic Area. Sub-processors headquartered in the United States include Twilio, PostHog, Brave Software, OpenAI, Anthropic and Groq.
Things to keep in mind
Risks and trade-offs to weigh before adopting Omnifact.
- Masking is not non-transmission: prompts still reach the chosen model provider once entities have been replaced by tokens
- The protection is defeatable by ordinary human behaviour — Click to Reveal unmasks fields and the double-percent syntax excludes text from the filter entirely
- The terms explicitly reserve the case where technical constraints force model servers outside the European Economic Area, including in the United States
- Groq is offered as a provider without a compliant DPA, and activating it shifts responsibility onto the customer
- Several sub-processors are US-headquartered, and Omnifact itself warns that EU case law recognises no adequate level of protection there
- Accuracy of the AI's output is expressly excluded from the contract, so answers about policies or regulations still need human verification
- Convenient internal knowledge retrieval can quietly erode the habit of reading source documents; audit logs record usage but do not restore that judgement
Setup & Integrations
Technical difficulty
Low for end users, moderate for administrators. Signing up takes minutes, the documentation promises a five-minute quickstart, and no prior AI knowledge is expected. Administrators have more to configure: the team-wide Privacy Filter, groups and SCIM, two-factor authentication and model allow-lists. Deeper work is optional but real — enterprise single sign-on, Microsoft admin consent for SharePoint and OneDrive, and connections to CRM or document systems through APIs. On-premise or customer-cloud deployment is an infrastructure project reserved for Enterprise. Onboarding, staff training and the paid Academy add-on exist to absorb that effort.
Deployment
Integrations
Supported languages
Behind Omnifact
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Omnifact.
Frequently asked questions
Is my data used to train AI models?
Where is the data hosted?
How much does Omnifact cost?
Is there a free plan?
Can an individual sign up?
Which AI models are available?
Does Omnifact offer an API?
Are the sub-processors published, and can I delete our data?
Should you pick Omnifact?
Omnifact is one of the more credible answers to a question many European organisations are stuck on: how to give staff real generative AI without sending confidential material to an American cloud on trust alone. The company is registered and identifiable, the legal documentation is complete and internally consistent, and the sovereignty claim is backed by an Article 28 agreement that names every sub-processor rather than by a badge on a homepage. The Privacy Filter is explained down to its detection methods, and the customer list — a German bank, a federal finance agency, universities and municipalities — is exactly the audience the product describes.
Two reservations deserve to be held in mind. Masking is not the same as not transmitting: prompts still reach OpenAI, Anthropic, Google or Mistral once entities have been replaced, and users can deliberately unmask fields or exclude text from the filter, so the protection depends on how disciplined the organisation is. And the commercial model is firmly enterprise-shaped — no free plan, business customers only, and most of the governance features that justify the platform in the first place, from single sign-on to on-premise deployment, sitting behind an Enterprise quote that is not public.
For a regulated organisation of meaningful size that already knows it needs data residency in the EU and an auditable trail, Omnifact is worth a serious evaluation, and the 10-day trial costs nothing to start. For a small team, an individual, or anyone expecting a transparent price for the full feature set, the fit is poorer. Verify the availability commitment before signing: the terms state 99.5% while the Data Processing Agreement states 99.9%, and only the German version of the terms is legally binding.
- Choosing a selection results in a full page refresh.
- Opens in a new window.