Head-to-head · updated 13 September 2026
DataShield vs Bedrock Knowledge Bases: who checks the retrieval was allowed?
Bedrock Knowledge Bases does the boring part of RAG. Well. Point it at S3, SharePoint, Confluence, or Google Drive. AWS parses the files. It chunks them, embeds them, reranks the hits. Then it hands your agent an MCP tool. Agentic retrieval goes further still. It splits a hard question into sub-queries. It streams back a cited answer. AWS calls the job "grounding agents and applications on enterprise data". Is your estate on AWS? This is on the bill.
We work a layer below the retriever. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data: that's special. We log it, always. Embeddings get made on your own hardware. By a local model. The vectors sit in your own Postgres. Each checked call lands in a hash chain. You can check it yourself, without trusting us. Most AWS shops should run both. Really. Here is where each one earns its keep. Sources at the bottom.
The short version
Pick DataShield when
- Someone will one day ask you to prove the lookup log wasn't edited. CloudTrail tells you what happened. Fair enough. It can't tell you the record is intact. Run the verifier.
- Your documents carry PHI or regulated PII. You'd rather the index carried tokens. A leaked vector store then leaks
TOK_strings, not names. See how the ontology maps it. - Embeddings must not leave the building. Ours get made locally, by a small open model. They land in your own Postgres
pgvector. - Part of the estate isn't on AWS. We ship Docker images. Run them on your tin. The audit chain verifies wherever you take it.
Pick Bedrock Knowledge Bases when
- You want the managed pipeline. Seven sources. Smart parsing of PDFs, decks, and scanned pages. Embedding and reranking, included at no extra charge.
- You want agentic retrieval. It plans sub-queries. It searches across several knowledge bases. It judges whether it has enough. Then it streams a cited answer. We do hybrid keyword and vector search. We don't do that.
- You want document ACLs crawled for you. From SharePoint, OneDrive, Google Drive, and Confluence. Re-checked live, at query time. It fails closed on error. That's real work. Done well, too.
- Zero ops is the point. $5 per GB per month. $1 per 1,000 retrievals. On a bill your finance team already signed.
Bottom line: Bedrock retrieves. We govern what's in the chunk. We govern who may ask for it. We govern what you can show later. On AWS? Run both. Keep the pipeline. Tokenize before it indexes.
Feature by feature
Competitor cells describe what AWS's public site says. Docs too. We use the date above. If we got something wrong, email support@myorg.ai. We'll fix it and credit you.
| What matters | DataShield | Bedrock Knowledge Bases | Edge |
|---|---|---|---|
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are chained, too. Verification names the exact failure. Tampering. Insertion. Deletion. Or truncation. Try the verifier demo. | CloudTrail for API calls. Plus AgentCore Observability traces and per-knowledge-base metrics. Good for debugging. We found no public tamper-evidence method. Not for that data. | ◆ |
| Who the retrieval is for | Auth issues MCP tool tokens. Each carries a scope ceiling. It re-checks access on each checked call. It meters the call against the agent. Ontology's MCP server gates each tool by API-key tier. ID gets checked here. Not just supplied. | ACL-aware retrieval filters on a user context. Your application passes it in. AWS states this plainly. It does not authenticate end users. This "does not constitute true authorization", they say. Email is the only user ID. No cross-provider mapping. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes on its own. It can't be quietly deleted from the log. | Not described in the docs we read. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor IDs carry HMAC commitments. The chain still checks after erasure. | Standard AWS deletion and retention controls. You re-sync the data source, yourself. What erasing a person does: not documented. Not for lookup history. | ◆ |
| Sensitive data handling | We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data: that's special. We log it, always. Chunk views mask at read time, too. We rebuild the keyword index from the masked text. So search can't probe for a redacted value. | Guardrails run at retrieval and generation. Nothing de-identifies field values first. Not before they become vectors. AWS notes a gap, too. The sensitive-information filter skips PII. In tool call inputs, tool results, and tool definitions. | ◆ |
| Document-level access filtering | Access runs by dataset, role, and tier. Not by crawled document ACL. We don't read your SharePoint rights. If that's the job, they do it. We don't. | Crawls allow and deny lists, for users and groups. Re-verifies live, against SharePoint, OneDrive, Google Drive, and Confluence. Fails closed. S3 and Custom sources rely on a metadata file. One you maintain. | ◇ |
| Retrieval and ingest pipeline | Hybrid keyword and vector search, over pgvector. Ingest from files, URLs, and S3-compatible storage. PDF, DOCX, and EML extraction, too. Corpus promote and demote get logged. No graph retrieval. No managed reranker. | Seven sources. Smart multimodal parsing. Embedding and reranking, managed, at no extra charge. Hybrid search. GraphRAG on Neptune. NL2SQL over Redshift. Agentic multi-hop retrieval, too. Broader than us, by a distance. | ◇ |
| Embedding and index custody | Local nomic-embed-text vectors, 768 dimensions. Into your own Postgres pgvector table. No text leaves your infrastructure. No vectors, either. | The datastore is "managed completely by Bedrock". No direct access. Bring your own vector store is still supported. But it gives things up. Sources. Agentic retrieval. ACL filtering. The gateway target. | ◆ |
| MCP and agents | More than 200 MCP tools span four surfaces. Ontology, Auth, Corpus, and Lighthouse. Retrieval, catalog, classification, and audit sit behind one surface. | AgentCore Gateway exposes a managed knowledge base. As two MCP tools: Retrieve and AgenticRetrieveStream. Admin-controlled parameter subsetting, too. Managed knowledge bases only. IAM auth only. | ◈ |
| Deployment | Self-hosted. In your own cloud or data center, your call. Or a dedicated single-tenant server we operate. Docker images cover Auth, Ontology, Corpus, and Lighthouse. Your keys, always. | AWS regions only. Not self-hostable. Fine, if you're all in on AWS. Awkward, though. Say a residency rule says otherwise. Or a second cloud. | ◆ |
| Maturity signals | Live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. | GA since November 2023. OpenAI, Syngenta, MRH Trowe, and Sony. All named on the product page. The whole AWS assurance programme stands behind it. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Listed per-unit rates. $5.00 per GB of raw data. Per month. Plus $1.00 per 1,000 Retrieve calls. Plus $4.00 per 1,000 agentic calls, on top. Cheap. Visible without a call. | ◈ |
◆ DataShield leads◇ Bedrock Knowledge Bases leads◈ comparable
Knowledge Bases claims come from aws.amazon.com. Plus the Amazon Bedrock User Guide. Last checked on 13 September 2026. We link them below. Not just a paraphrase from memory.
Three things you get here that you won't get from a managed RAG service
Tokens in the index, not names
A vector store is a copy of your documents. It's in a shape nobody reviews. Tokenize the sensitive fields at ingest. Then that copy holds TOK_ strings. The mapping lives in the ontology. The key custody story is on the security page. A lookup is an admin-tier call. Audited before it returns. Tokens stay join-friendly, so analytics still work.
An identity the service checked
Bedrock's ACL filter trusts the email. The one your app hands it. That's a fine design. AWS says so, in the docs. It just means one thing. The filter's strength is your app's strength. Our MCP tool tokens carry a scope ceiling. The holder can't exceed it. Access gets re-checked on each checked call. So an analyst who leaves at 2pm stops working. Right at 2pm. How Auth does it.
Proof that travels
Traces live in the account that made them. Evidence should outlive the platform, though. Our audit rows chain to each other. Checkpoints get signed. The verifier says which it found. Tampering. Insertion. Deletion. Or truncation. That's what EU AI Act Article 12 reviewers ask about. Mostly. Most of all. Same for HIPAA §164.312(b). Try it in your browser, no signup.
Where Bedrock Knowledge Bases is genuinely stronger
On retrieval itself, they win. No argument there. Seven sources. A parser that copes with scanned pages. And slide decks. A managed embedding model. A reranker, thrown in free. Hybrid search. Graph retrieval on Neptune. NL2SQL over Redshift. Agentic retrieval, too. It plans sub-queries. It streams a cited answer. Our RAG is hybrid keyword and vector search. Over pgvector. With honest ingest and audited corpus moves. It is good. It is narrower, too. Their ACL crawling beats the usual hand-waving, as well. Allow and deny lists from four SaaS sources. Deny beats allow. Live re-verification, at query time. A fail-closed rule. A timeout returns nothing, rather than too much. Then add the AWS bill you signed. I'd find that hard to argue with. Truly.
Here's the push-back, though. It comes from AWS's own page. The heading reads "ACL awareness is not authorization". The text underneath says one thing. Bedrock does not authenticate end users. It cannot check the ID context you pass. You must not rely on the feature alone. They say so. Not as a sole access control. The ID is an email. No alias resolution. No cross-provider mapping. Group membership: only as fresh as the last sync. Also true. Meanwhile, nothing in the pipeline changes the chunk itself. Not before it becomes a vector. So the index holds raw values, still. The filter trusts a string. The record of what was fetched: telemetry. Fix those three things. Then the pipeline gets a lot easier to defend. In a room with an auditor in it.
Questions worth asking both of us
These are the questions we'd want answered. If we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove a retrieval log entry wasn't deleted?
DataShield: yes, it can. Cleanly. Each record commits to the one right before it. Checkpoints get Ed25519-signed and chained. Verification tells deletion apart from truncation and from tampering. Try it at /verify. Bedrock: CloudTrail records the API call. AgentCore Observability holds the traces. We found no public tamper-evidence method for either. Ask AWS what stops a log group from shrinking. Ask what you'd hand an examiner.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. Revocation bites on the very next call. For Bedrock, the lookup gets gated. By the IAM role that calls it. Plus the user context your app passes. We found nothing that pulls an agent's access, mid-flight. Not to a knowledge base. Ask how long a compromised agent keeps reading data. After you pull its access. Ask who is responsible for noticing.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material. Then it issues an ISO 27560 consent receipt. Actor IDs in the chain carry HMAC commitments. Evidence still checks after the subject is gone. For Bedrock, you delete the source file and re-sync. That handles the index. But we couldn't find what erasing a person does. Not to the lookup history. Ask whether erasure breaks the record you'd rely on.
Is Bedrock's ACL-aware retrieval an access control?
AWS says no, in a heading. "ACL awareness is not authorization" is their wording. A plain statement follows. Bedrock does not authenticate end users, it says. You must not rely on the feature alone. Not as a sole access control. It filters on an email your application supplies. That's a reasonable split of duties. Fair, that. It does mean one thing, though. The upstream ID check is yours to build. Many teams reach for metadata filters instead. AWS calls those a relevance feature. Not a security one.
Where do our embeddings and documents actually live?
With us: on your infrastructure. Text turns into vectors locally, by nomic-embed-text. It's stored in your own Postgres pgvector table. With a Bedrock knowledge base, the store is a black box. Sealed. No peeking allowed. No peeking. In AWS's own words: "managed completely by Bedrock". Inside AWS regions. No direct access. You can bring your own vector store instead. But that path gives things up. Links. ACL filtering. Agentic retrieval. The AgentCore Gateway target. Ask which half of the product you're actually buying.
Does DataShield have SOC 2?
Not yet. We won't imply otherwise, ever. You're comparing a young product from a small team. Against AWS. Weigh that honestly. Auth ships with a public threat model. Plus a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow. That way, a small vendor stands less alone. Details on the security page. Already on AgentCore? Our head-to-head on that covers the runtime side.
- Knowledge Bases positioning: "Give foundation models and agents contextual information". From your company's own data. Under the banner: "Grounding agents and applications on enterprise data". - aws.amazon.com/bedrock/knowledge-bases, 13 Sep 2026
- AWS notes ACL-aware retrieval, under one heading. "ACL awareness is not authorization". Bedrock "does not authenticate end users". The filter "does not constitute true authorization". Email is the universal ID. With "no alias resolution or cross-identity-provider mapping". - Amazon Bedrock User Guide, 13 Sep 2026
- Managed knowledge bases get seven sources. Plus agentic retrieval and AgentCore Gateway integration. Customer-run ones get S3 and Custom sources. That datastore is "managed completely by Bedrock". - Amazon Bedrock User Guide, 13 Sep 2026
- Published rates: $5.00 per GB of raw data per month. That's for index storage. Plus $1.00 per 1,000 Retrieve calls. And $4.00 per 1,000 agentic retrieve calls. Plus the underlying retrievals. Managed parsing, embeddings, and reranking. All at no extra charge. - aws.amazon.com/bedrock/pricing, 13 Sep 2026
- AgentCore Gateway exposes a managed knowledge base. As two MCP tools:
RetrieveandAgenticRetrieveStream. "Supported only for managed knowledge bases. Only with IAM-based outbound authentication". - Amazon Bedrock User Guide, 13 Sep 2026 - Bedrock Guardrails sensitive-information filters "evaluate text content only". In tool-use workloads, they skip PII. Not in tool call inputs. Not tool results. Tool definitions get missed too. - Amazon Bedrock User Guide, 13 Sep 2026
Other head-to-heads
DataShield vs Azure AI Search
Azure wins lookup scale. Plus permission-aware knowledge bases. DataShield.
Same marketDataShield vs LlamaIndex
LlamaIndex wins document parsing and extraction. DataShield adds tokenized data.
Same marketDataShield vs Cortex Search
Cortex Search is fast managed RAG, inside Snowflake. We add tokens.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
Already indexing into Bedrock? Good, keep it. Come see the two things it leaves to you. Tokenize a dataset. The index then holds TOK_ strings. Break a live audit chain. Watch the verifier name exactly what you did. Demo Center access is free with a work email.
You've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →