Data Residency, Retention & Compliance

When evaluating or rolling out Omnifact, data protection officers (DPOs), IT administrators, and legal teams need clear, verifiable answers about where data is processed, whether prompts are retained by providers, and how compliance is documented.

---

​

Where Your Data Is Hosted

Omnifact GmbH is headquartered in Germany. All core Omnifact platform infrastructure (including our application servers, databases, vector search indexes, code-execution sandboxes, and the Omnifact Privacy Filter™) is hosted in the European Union. When you send a message in chat, two layers determine where your data goes:

1. Omnifact Platform (Always EU): Your message, attachments, and Space knowledge are processed and masked by the Privacy Filter inside Omnifact’s EU infrastructure.
2. Selected AI Model Provider (EU or US, based on the model flag): The masked prompt is sent to the AI model you selected in the model picker.

​

What the EU and US Flags Mean in the Model Picker

Every model in the chat model selector displays a flag indicating the region where model inference runs:

• 🇪🇺 EU flag: Your prompt is processed on servers physically located in the European Union.
• 🇺🇸 US flag: Your prompt is transmitted to and processed on servers located in the United States.

---

​

Model Training & Zero Data Retention (ZDR) by Provider

Omnifact uses enterprise API agreements across all integrated model providers.

• No model training (all providers): Neither Omnifact nor any of our integrated AI model providers use your prompts, uploaded documents, or model responses to train or improve foundation models.
• Zero Data Retention (ZDR): Under Zero Data Retention, a model provider processes your request in memory and does not retain prompts or completions for abuse monitoring or logging after returning the response.

The table below shows the hosting region, training policy, and current Zero Data Retention status for every platform-managed provider in Omnifact:

---

​

US CLOUD Act & European Sovereignty

Organizations subject to strict European sovereignty requirements often ask how the US CLOUD Act affects EU-hosted models:

• Omnifact infrastructure & Mistral AI: Omnifact GmbH is a German company, and Mistral AI is a French company hosted in the EU. Neither is a US entity.
• EU-hosted US cloud providers (Azure OpenAI, Anthropic EU, Google EU): When you use these providers, model inference takes place exclusively in European Union data centers under contractual EU data residency commitments. However, because the parent cloud providers (Microsoft, Google, Anthropic) are US-headquartered companies, they remain subject to US jurisdiction in principle.
• How to mitigate exposure:
  1. Keep the Privacy Filter enabled: Because the Privacy Filter runs on Omnifact’s own EU servers before the model call, personal names, email addresses, IBANs, and client names are replaced with placeholders ([Person:1], [Organization:1]) before the request ever reaches Azure or Google Vertex.
  2. Restrict to Mistral AI if required: If your compliance policy prohibits US-headquartered sub-processors even with EU data residency and masking, administrators can disable all other providers in Team Settings > Models so only Mistral AI models are available.

---

​

File Storage, Indexing & Deletion

​

What Happens to Uploaded Documents?

When you upload a file to a Space’s Uploaded Files, Omnifact runs it through an ingestion pipeline inside our EU infrastructure:

1. Text extraction and chunking: Omnifact extracts the text and splits it into searchable segments (chunks).
2. Vector indexing: Those text chunks and their vector embeddings are stored in Omnifact’s encrypted EU database so the Space agent can retrieve relevant passages.
3. Original file deletion: Once indexing is complete, the original uploaded file is deleted. Omnifact retains only the extracted text chunks and embeddings needed for retrieval.

For Connected Sources (SharePoint, OneDrive, Google Drive), your original files remain in your own cloud storage. Omnifact stores only the indexed text chunks in the EU and automatically deletes them when a file is removed in your cloud storage or when the source is disconnected.

​

Deleting Chats, Documents, and Spaces

• Deleting a chat: Users can delete any of their conversations from the left sidebar at any time. Confirming deletion permanently removes the conversation and its messages.
• Deleting a Space document or Space: When a Space editor deletes a document from Uploaded Files or deletes an entire Space, all associated text chunks and embeddings are permanently removed.
• Trial and account closure: If an organization’s trial ends without converting or a subscription is terminated, customer data is deleted from Omnifact’s systems in accordance with our Data Processing Agreement.

---

​

Compliance Paperwork for DPOs & IT Security

All formal compliance and data protection documentation is maintained in the Omnifact Trust Center at trust.omnifact.ai:

​

How to Request Provider Documents

1. Visit trust.omnifact.ai and click Request Access on any restricted compliance document or sub-processor assessment.
2. Enter your work email address and organization name to receive access.
3. Need a countersigned DPA (AVV) or help completing an internal DPO or information-security questionnaire? Contact your account manager or email support@omnifact.ai.

​

Related Resources

• How the Privacy Filter Protects Your Data: See what the Privacy Filter masks, where it runs, and what is outside its scope.
• Model Management: Enable or disable specific providers and models across your organization.
• Group Management: Control access to US-hosted models and Privacy Filter exemptions per user group.
• Model Guide: Compare model tiers, strengths, and hosting regions.