OneTutor
OneTutor is an AI tutoring platform for universities, academies and training providers. Lecturers upload their own course materials; the tutor answers only from that approved content, cites the exact source page, generates quizzes and reports aggregated learning insights.
What is OneTutor?
OneTutor is a German learning platform that turns an institution's own teaching material into a course-specific AI tutor. It is published by OneTutor GmbH in Munich and presents itself as a spin-off of the Technical University of Munich. Its defining constraint is documentary: the tutor answers only from files a lecturer has uploaded and enabled, and every answer links back to the page or slide it came from. When a question falls outside that corpus, the tutor says so rather than improvising — a retrieval-augmented design the vendor presents as its main difference from general-purpose chatbots.
The platform is organised in three modules. Tutor offers one-to-one support in two answer modes, step-by-step scaffolding or a direct answer, plus a highlight-and-explain function for any passage in a script. Practice turns the same material into exercises: multiple choice, free text with written AI feedback, voice input and image upload for maths problems or diagrams. Questions proposed by the model must be reviewed and released by the lecturer before learners see them. Analytics gives each course owner a dashboard of weekly active learners, per-topic quiz results, chat insights and clusters of recurring questions, aggregated and anonymised.
Uploads can be text files, PDFs, audio, or video from which only the audio track is used. The vendor reports that PDFs of around seven hundred pages and recordings of about three hours work well, with five to ten minutes of processing. A course language can be chosen from twenty-eight options for generated quizzes, while the tutor still understands and answers in others.
On the institutional side, OneTutor connects through single sign-on with Shibboleth, Azure AD or Keycloak, and runs inside an LMS via LTI 1.3 alongside Moodle, ILIAS and Canvas. Each institution gets its own instance on its own subdomain, and the platform is described as LLM-agnostic, including on-premise and open-source models. Hosting is in Germany. The vendor claims more than forty universities and over forty thousand learners, and the product is the subject of a three-year independent study run by the Bavarian bidt institute across ten universities.
What it does
- Answer student questions strictly from the lecturer's own course materials, with a link to the exact source page
- State plainly that a question is outside the approved material instead of producing an invented answer
- Generate quiz and exercise questions from the uploaded content, for lecturer review before release
- Mark a passage in a script and have it explained in the context of the course
- Grade free-text answers with written feedback, and accept voice or image input
- Show a course dashboard of usage, per-topic quiz results and clusters of recurring questions
- Run inside the institution's LMS through LTI 1.3 and behind its single sign-on
When to use OneTutor / When not to
A quick filter to help you decide if OneTutor is the right fit.
When to use OneTutor
- Universities and universities of applied sciences that want to govern how generative AI is used in teaching rather than leave it outside the institution
- Lecturers running large cohorts, where individual follow-up is impossible: the published case study describes courses of thirty to eighty participants
- Academies and training providers whose learners study alone between sessions or prepare for a certification exam
- Institutions already running Moodle, ILIAS or Canvas and an institutional single sign-on, since the platform plugs into both
- Teaching teams in definition-heavy subjects such as physics, statistics or quality management, which lecturers report work best
When not to use OneTutor
- Individual learners outside a participating institution: access runs through institutional single sign-on or a guest account granted on request
- Anyone looking for a general-purpose assistant, since the tutor deliberately refuses to answer beyond the approved course material
- Teams that need programmatic access: no product API and no developer documentation exist anywhere on the site
- Mobile-first users: there is no iOS or Android application, only a web platform
- Buyers who need a published price list before talking to sales, as no amount is quoted anywhere on the site or in the application
How to use OneTutor
A typical end-to-end flow, from setup to results.
- Request access: teachers and administrators fill in the trial form, or ask for a guest account by email if their institution is not connected yet
- Learners at a connected institution simply sign in with their existing institutional credentials, with no separate account to manage
- Accept the privacy notice shown at first login, together with any additional disclaimer added by the institution
- Create a course and upload the existing material: scripts, slides, exercises, PDFs, recordings or exam-preparation content
- Wait five to ten minutes while the material is processed and made available to chat and quizzes
- Enable or disable each document individually, so content can be unlocked as the semester progresses
- Set the course language used by default for automatically generated quiz questions
- Let the AI propose quiz questions, review them, then release the ones that are good enough for learners
- Point learners to the course so they can ask questions, practise and prepare for the exam
- Read the course dashboard to see where learners struggle, then adjust the material or the lecture accordingly
Pros & Cons
Pros
- Answers are anchored in the lecturer's own material and cite the exact source page, so a student can verify what the tutor says
- The tutor refuses to answer outside the approved corpus instead of improvising, which is the behaviour the vendor designed for
- The lecturer keeps didactic control: choice of documents, per-document activation, and mandatory approval of generated exercises
- Hosting in Germany, Azure OpenAI processing confined to the EEA, and an explicit statement that transmitted data is not used to train models
- Six subprocessors are named in the privacy policy with their legal entity and address, and an external data protection officer is identified in full
- Genuine institutional plumbing: single sign-on, LTI 1.3, and a separate instance per institution on its own subdomain
- Independent evaluation exists: a three-year bidt study across ten Bavarian universities, whose first published results cover eighty-four courses
Cons
- No terms of use are published anywhere on the site or in the application, although the service processes learner data
- No price is published at all: neither a pricing page nor a single amount appears on the domain or in the application bundle
- No minimum age and no parental consent clause are stated anywhere, on a product used by learners
- The public website loads several third-party marketing and analytics services with no cookie banner and no cookie policy, and the privacy policy covers only the application
- Consent at login is a single mandatory checkbox covering both the privacy statement and the collection of data, with no granularity
- Course-related data is kept indefinitely unless the user asks for deletion, with no automatic anonymisation
- No product API and no native mobile application, so no automation and no offline or app-based use
Pricing & Plans
No price is published. OneTutor does not operate a pricing page, and no amount or currency appears anywhere on the website, in the sitemap or in the application itself; every commercial path leads to a demonstration booking instead. A free trial does exist, but it is granted manually to teachers and administrators after a request, and institutions that are not yet connected can ask for a guest account. No permanent free plan is announced. The only pricing statement made on the site is qualitative: the vendor promises predictable costs and clear pricing with, in its words, no token price surprises. A quotation must therefore be obtained from the vendor.
Data, GDPR & hosting
A consolidated view of how OneTutor handles your data.
GDPR overview
GDPR implementation is documented in concrete terms. The privacy policy names the GDPR, the German Digital Services Act, the Bavarian Data Protection Act and the Bavarian Higher Education Innovation Act, and states a legal basis for each processing purpose: consent under Article 6(1)(a), contract performance for authentication, legitimate interest for auditing, and Section 25(1) TTDSG for cookies. An external data protection officer is named with a postal address, phone number and email. Data subject rights under Articles 15 to 18 are described with a one-month response commitment, and the competent supervisory authority is identified. The vendor confirms that no automated decision-making under Article 22 takes place, invokes data protection by default under Article 25, and advertises itself as ready to sign a processing agreement with the institution. No Article 27 representative is required, the company being established in Germany.
Who owns the data?
The controller is OneTutor GmbH in Munich, which has appointed an external data protection officer, Kertos GmbH. The privacy policy states that personal data is treated confidentially and is not passed to third parties, publicly or without authorisation, and that access is limited to staff who need it. Course content stays under the lecturer's control: they decide which documents the tutor may use, can enable or disable them one by one, and must approve exercises before publication. Processing rests mainly on consent under Article 6(1)(a) GDPR, with contract performance for authentication and legitimate interest for auditing changes made by course managers. The platform runs under institution-specific names, such as TUMTutor.
Reuse rights
No terms of use are published anywhere on the domain or in the application, so no licence governing what a user may do with content produced on the platform is available to read. What the documents do say is narrower. Users are required to comply with applicable law, in particular copyright and data protection, and the help centre carries a dedicated article on the copyright rules a lecturer must follow before uploading material. Users are also asked, at first login, not to enter personal data into the input fields, because filtering is not complete. On the vendor's side, only the direct user input is transmitted to OpenAI and Azure OpenAI, and the policy states that this data is not used to train the models or for any other purpose. Pseudonymised usage data is analysed to improve the platform and to evaluate its effectiveness scientifically, on consent that can be withdrawn at any time.
Data retention & training
Hosting summary
Web servers are operated by Amazon Web Services EMEA SARL, based in Luxembourg, and the site states that the platform is hosted in Germany with German data residency. Identity management runs on AWS Cognito. AI processing is split between OpenAI and Azure OpenAI, with Azure processing confined to the European Economic Area under the Azure Data Zone standard. Error monitoring uses Sentry, a service of Functional Software Inc. in San Francisco, whose event data is stored in EU data centres of Google Cloud Platform; a processing agreement and EU standard contractual clauses are in place for any third-country processing during maintenance. The privacy policy notes that the Google data centres are certified to SOC 2 Type II, ISO/IEC 27001 and PCI-DSS, which are Google's certifications and not the publisher's. The vendor says it monitors the legal framework for international transfers on an ongoing basis. The domain itself resolves to a Cloudflare anycast node, which is a delivery point rather than a data hosting location.
Things to keep in mind
Risks and trade-offs to weigh before adopting OneTutor.
- No terms of use are published anywhere, so the contractual rules governing the service are simply not available to read before signing
- No minimum age and no parental consent mechanism are documented, and there is no age check in the login flow, on a platform used by learners
- Consent at first login is a single mandatory checkbox covering both the privacy statement and the collection of data, which leaves no granular choice to a learner who still needs to use the course
- Course-related data is stored indefinitely by default, with no automatic anonymisation; the learning history of a student remains until someone asks for it to be deleted
- The SOC 2 Type II, ISO/IEC 27001 and PCI-DSS certifications quoted in the privacy policy belong to Google Cloud Platform's data centres, not to OneTutor; the product page speaks of ISO-aligned operations, which describes a framework rather than a certificate held
- The data protection officer's email address sits on a third party's domain, so a GDPR request does not reach the publisher directly
- A tutor that answers only from approved material can encourage learners to stop looking beyond the syllabus, and the vendor itself asks users never to type personal data into the chat because filtering is not complete
Setup & Integrations
Technical difficulty
Two very different efforts. Trying the tool is trivial: a form, manual verification by the vendor, then uploading existing files, with the vendor promising no IT setup and readiness in minutes. Processing an upload takes five to ten minutes. A real institutional rollout is a project: single sign-on with Shibboleth, Azure AD or Keycloak, and an LTI 1.3 integration activated per institution, both of which involve the IT department. No course redesign is required, since the platform reuses existing scripts, slides and recordings, and the vendor explicitly targets teaching teams who are not technology enthusiasts.
Deployment
Integrations
Supported languages
Behind OneTutor
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement OneTutor.
Frequently asked questions
What does the OneTutor AI tutor base its answers on?
What happens if a student asks something the course does not cover?
Which file formats can be uploaded, and how long does processing take?
How does an institution deploy OneTutor?
Where is the data hosted, and who processes it?
Is student data used to train AI models?
How long is data kept?
How much does OneTutor cost, and can it be tried first?
Is there an API or a mobile app?
Should you pick OneTutor?
OneTutor is a narrow, well-executed product rather than a general assistant, and that narrowness is its main argument. By confining the tutor to material a lecturer has explicitly approved and by citing the source of every answer, it makes verification possible and gives teaching staff a reason to trust what students are told. The institutional plumbing is real: single sign-on, LTI 1.3 integration with the usual learning management systems, a dedicated instance per institution, hosting in Germany, and a privacy policy that names its subprocessors and states that transmitted data is not used to train models. Unusually for this market, the product is also under independent evaluation, through a three-year study run by the Bavarian bidt institute across ten universities, whose first published results cover eighty-four courses.
The reservations are documentary rather than technical. No terms of use exist anywhere on the domain or in the application, no minimum age or parental consent clause is stated, and the public website loads several third-party marketing and analytics services with no cookie banner and no cookie policy, while the only privacy policy covers the application alone. Consent at login is a single mandatory checkbox, and course data is kept indefinitely unless a user asks for deletion. Pricing is entirely opaque, and access runs through the institution, so an individual learner cannot simply sign up.
For a European institution that already runs an LMS and an identity provider, and that wants to bring AI-assisted learning inside its own governance, OneTutor is a credible candidate. It should be assessed the way any processor is assessed, with the missing contractual documents requested in writing before deployment.
- Choosing a selection results in a full page refresh.
- Opens in a new window.