Head-to-head · updated 13 September 2026
DataShield vs Amazon DataZone: what governs the data your AWS catalog can't reach?
Amazon DataZone is the work catalog for an AWS estate. Since re:Invent 2024 it is also the engine under Amazon SageMaker Catalog. Its own page calls it "a data management service that makes it faster and easier for customers to catalog, discover, share, and govern data stored across AWS, on premises, and third-party sources." A source posts a Glue table. A user asks for it. An owner OKs it. Lake Formation grants the access. For real. If your data sits in Glue and Redshift, that loop is hard to beat. It costs you almost nothing per seat now.
We sell the next layer. A different blast radius, too. We tokenize datasets at ingest. Agents query the tokens over MCP. Turning a token back is a privileged step. It gets audited. Fields carry labels from 129 PII, PHI, money and secret classes. Verdicts repeat the same way each time. We check each ruled call against the agent's live rights before it runs. Each decision seals into a chain you can verify yourself. None of that needs an AWS account.
The short version
Pick DataShield when
- Your private data is not all in AWS. DataZone grants real access to just Lake Formation run Glue tables and Redshift. Everything else is just an EventBridge event. You wire it up yourself.
- You want PII and PHI labels in the catalog itself. Not in a second console with its own bill. DataZone has no built-in classifier. See what we label.
- Agents act on the data. You need per-agent rights you can pull mid session. AWS agents inherit IAM. IAM does not reach inside a live plan. How Auth does it.
- An examiner asks you to prove a March record was not edited. CloudTrail is a log. Ours is a signed chain. Run the check.
Pick Amazon DataZone when
- Your estate is Glue, Redshift, Athena and S3. The catalog sits in the account already. The grant path has no lag.
- You want the subscribe and approve flow. A user asks. An owner clicks. Rights appear. That is a real product. Most catalogs just log the choice.
- You need column-level lineage from Spark jobs on EMR and Glue, plus quality rules from Glue Data Quality. Both shipped in 2026.
- Cost matters more than being able to move. There is no per-seat fee since November 2024. Core APIs are free.
Bottom line: if you live in AWS, keep DataZone. It catalogs the platform it sits on. It grants access there better than we do. It cannot label your PHI. It cannot follow your data to a new cloud. It cannot hand an auditor proof a query was OK'd. That is our half.
Feature by feature: an AWS data and AI catalog versus a governed data plane for agents
Competitor cells describe what the DataZone and SageMaker Catalog pages say. Also the DataZone user guide. Also the Unified Studio release notes, as of the date above. If we got something wrong, email support@myorg.ai. We'll fix it, and credit you.
| What matters | DataShield | Amazon DataZone | Edge |
|---|---|---|---|
| Catalog breadth | Assets, columns, a work glossary, typed lineage. Plus a 29-command steward flow. We register a source over a live link and scan it in place. No rows leave it. That is PostgreSQL today, not your whole estate. Snowflake, BigQuery, Databricks, S3 and Salesforce are named, with no handler yet. | Glue Data Catalog tables, Redshift, S3 object sets, BI dashboards, ML models, and custom asset types. Teradata and OpenSearch arrived in July 2026. Metadata also syncs both ways with Collibra, Atlan and Alation. | ◇ |
| Where access is actually enforced | At our own read path. Queries run against masked views and tokenized columns. Each ruled tool call passes a scope gate and a rights check first. Same rules on any cloud, or none. | The user guide is blunt about the edge. Access grants cover Lake Formation run Glue tables and Redshift tables and views. For all other assets, DataZone sends an EventBridge event. You build the rest. | ◆ |
| PII and PHI classification | 129 field classes cover PII, PHI, money data and secrets. All 18 HIPAA Safe Harbor IDs too. Regex, checksum checks, column-name word lists, and pattern filters do the work. No model. A verdict repeats the same way from a config digest. | None built in. The catalog carries work metadata and Glue quality rules. For private data, you add Macie or a Glue check. Each is billed on its own. | ◆ |
| Tokenization and data handling | We tokenize datasets at ingest. Agents query the tokens over MCP. Turning a token back is a privileged, audited step. Tokens repeat the same way each time. They keep joins. A vault can reverse them. We also generalize near-ID fields. Dates go to year, decade or age band. ZIPs go to 3 or 4 digits. Phones, SSNs and emails get part masks. Each gets a score for how much it hides. | No tokens, masks or field generalizing here. The catalog describes data. It does not change it. | ◆ |
| Sample values in the catalog | Default is: leave it out. No column value gets copied into the catalog. Storing plain samples needs a clear opt-in. That opt-in writes an audit row. | We found no written sample-value rule for catalog assets. Worth asking them what profiling keeps, and where. | ◆ |
| Lineage | Typed lineage over an edges set of terms. Both ends get an access check at each hop. Plus impact tracing. It comes from the jobs that own the links. Not a stored column-level graph. | OpenLineage-style lineage from Spark on EMR, Glue, Visual ETL and notebooks. One combined job view since March 2026. Column-level lineage on the SageMaker Catalog page. Deeper than ours. | ◇ |
| Agent authorization | Each ruled tool call passes a scope ceiling. Plus a tool allowlist and a rights tier. Plus a pull-back check, all before it runs. A pulled agent loses access on the next call. Delegation uses RFC 8693 token exchange, with a scope ceiling. | Agents inherit IAM and Lake Formation grants. SageMaker Data Agent reads catalog work context. Amazon Q Developer works with MCP servers. But we found no per-agent ID, scope ceiling, or mid-session pull-back in the docs. | ◆ |
| Audit evidence | SHA-256 row chain. Ed25519-signed checkpoints, chained too. A check names the failure: tamper, insert, delete, or cut short. Ed25519 signing keys stay on your instance. They sit in a key folder you control. Key-rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. It is not a shipped link yet. Try the check. | Usage logs in the portal. EventBridge events. CloudTrail for API calls. Useful records. Ones you can edit, too. No proof against tampering is shown. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. IP-allowed and step-up gated. It revokes itself. No one can quietly wipe it from the log. | Not offered. The emergency path in AWS is an IAM role change. Nothing forces a time limit on it. | ◆ |
| GDPR wipe | We crypto-shred each subject's key. Plus ISO 27560 consent receipts. Actor IDs in the chain are HMAC-locked. So the chain still checks out after the wipe. | No wipe tool. The catalog can say where a subject's data sits. Deleting it stays your job, in S3, Redshift, or wherever it lives. | ◆ |
| MCP and agents | More than 200 MCP tools, across Ontology, Auth, Corpus and Lighthouse. Auth hands out MCP tool tokens with scope ceilings. It meters each call against the agent that made it. Ontology's MCP layer checks an API key, with per-tool tier gates. | Amazon Q Developer in Unified Studio links to MCP servers. Re:Invent 2025 also showed analytics MCP servers, across Glue, Athena, Redshift and EMR. The SageMaker Catalog page itself makes no MCP claim. | ◆ |
| Deployment | Self-hosted, in your own cloud or data center. Or a single-tenant server we run for you. Docker images ship for Auth, Ontology, Corpus and Lighthouse. Guardian checks a signed deploy file. | Run by AWS, on AWS, per region. No self-hosted option, and no on-site option. None is on the public roadmap. | ◆ |
| Maturity signals | Live in production (Guardian and Lighthouse since April 2026). SOC 2 is planned, not attested. We say so up front. Field classing left shadow mode not long ago. We'd rather tell you that than have you find out. | GA since October 2023. Renamed SageMaker Catalog in December 2024. A busy 2026 release run. Named clients: Natera, Cisco, NatWest. It inherits the AWS compliance estate. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Published and cheap at the catalog layer. $10 per 100,000 requests. $0.40 per GB-month of metadata. $1.776 per compute unit. Plus per-token fees for AI tips. No per-seat fee since 1 November 2024. The real bill is the Glue, Athena, Redshift and Bedrock use underneath. | ◈ |
◆ DataShield leads◇ Amazon DataZone leads◈ comparable
DataZone claims come from five sources. The DataZone site. The DataZone user guide. The SageMaker Catalog page. The DataZone pricing page. The SageMaker Unified Studio release notes. Last checked 13 September 2026. We link them below. We do not just paraphrase from memory.
Three things you get here that you won't get from a platform catalog
Labels on the data, not just around it
A catalog entry says a table exists, and who owns it. It does not say column 14 is an MRN. We label fields against 129 classes. All 18 HIPAA Safe Harbor IDs too. No model in the loop. Same input, same verdict, each time. See the catalog.
Proof that survives an audit
CloudTrail says an API call happened. It cannot prove no one edited the record after. Our records form a chain with signed checkpoints. The check tells you what went wrong. Not just that something did. That is what EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
One rule set, any cloud
DataZone stops at the edge of your AWS account. Your PHI does not. Run our stack in your own data center. Or a new cloud. Or a single-tenant server we run for you. The same masks, tokens, and chain follow the data. See the architecture.
Where Amazon DataZone is genuinely stronger
The subscribe-and-approve flow is the good part. People don't give it enough credit. Most catalogs log an approval. Then someone emails a person to go make it true. DataZone approves and grants, through Lake Formation or Redshift. Nothing to sync. Nothing to drift. Add real column-level lineage from Spark jobs. Add Glue quality rules. AI-written notes come next, then a metadata sync with Collibra, Atlan, and Alation. Now you have a real catalog. It costs almost nothing per seat. AWS did the honest thing in late 2025. It exported catalog metadata as an Iceberg table. Now your inventory takes plain SQL. That blunts the lock-in case. It should.
Here is the push-back. Read the scope line in their own guide again. Grants cover Lake Formation run Glue tables and Redshift tables and views. Every other asset just gets an EventBridge event. So the further your data sits from Glue, the more this turns into a good index. An index of things it cannot control. Now add agents. SageMaker Data Agent reads catalog context now. Useful. Also a bit alarming: the agent learns more about your data. Its rights stay one shared IAM role, logged to a trail anyone can edit. A catalog can know your data is private. It still cannot stop a query. It cannot pull an agent's rights mid session. It cannot prove after the fact what it let through. That is two thirds of a job.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, with ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record links to the one before it. Checkpoints get signed and chained. A check tells deletion from a cut record from a tampered one. Try it at /verify. DataZone gives you portal logs, EventBridge events, and CloudTrail. Those are logs. Anyone with the keys can edit a log. Ask AWS what proves a record is unaltered, and who could alter it.
What happens to a revoked agent mid-session?
DataShield re-checks rights on each ruled call. A pulled agent loses access on the next call. In AWS, the agent runs under an IAM role. Changing that role does not stop a plan already in flight. Ask how long a hacked agent can keep reading tables SageMaker Catalog just described to it.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds each subject's key and issues an ISO 27560 consent receipt. Actor IDs in the chain are HMAC-locked. So the evidence still checks out after the subject is gone. DataZone has no wipe tool. It points at where the data sits. The delete, and a record you can defend, is yours to build.
Is this still DataZone, or is it SageMaker Catalog?
Both, for now. AWS's December 2024 press release says SageMaker Catalog is "built on Amazon DataZone," and the SageMaker Catalog page repeats it. As of 13 September 2026 the DataZone console, API, product page and pricing page are all still live. AWS has set no end date. Still, the brand is clearly folding in. Signing a multi-year plan? Ask one thing. Which console and API will you build against? What happens to your live DataZone domains?
Which of our non-AWS sources does DataZone actually govern?
This is the question we'd lead with. Their guide says grants cover Lake Formation run Glue tables and Redshift tables and views. For all other assets, DataZone posts an EventBridge event. So Teradata, OpenSearch, and S3 object sets are just catalog entries. Same for Snowflake or Databricks seen through Glue. You finish the flow yourself. Ask for a demo: a subscribe request fulfilled on a non-Glue source.
We need PII and PHI labels. Does the catalog do that?
Not on its own. DataZone and SageMaker Catalog handle work metadata, glossaries, AI-written notes, and Glue quality rules. For private data the AWS answer is Macie or a Glue check, in another console with another bill. We classify inside the catalog, against 129 classes. The label drives masking and tokenization on the same read path. Ask both of us to run the same messy table. Then compare the column list.
Does DataShield have SOC 2?
Not yet. SOC 2 is planned, not attested. We won't say otherwise. AWS has the full wall of certificates. We don't. What we offer instead: an open threat model. A check anyone can run. Docker images you host yourself. Your data never leaves your network. Design-partner terms include source escrow. So a small vendor isn't a single point of failure. Details on the security page.
- SageMaker Catalog hero: "Discover, govern, and collaborate on data and AI securely." The page says it is "built on Amazon Datazone." Named clients: Natera, Cisco, NatWest. - aws.amazon.com/sagemaker/catalog, 13 Sep 2026
- "Amazon DataZone supports granting access to AWS Lake Formation run AWS Glue tables and Amazon Redshift tables and views. For all other data assets, Amazon DataZone posts standard events … to Amazon EventBridge." - Amazon DataZone User Guide, 13 Sep 2026
- Published pricing: $10 per 100,000 requests, $0.40 per GB-month metadata storage, $1.776 per compute unit. Plus $0.015 per 1K input tokens and $0.075 per 1K output tokens for AI recommendations. - aws.amazon.com/datazone/pricing, 13 Sep 2026
- "As of Nov 1, 2024, there is no monthly user-based subscription charge for Amazon DataZone". Metadata storage cut from $0.417 to $0.40 per GB. - AWS What's New, 8 Nov 2024
- 2026 catalog releases: aggregated lineage view (17 Mar), metadata sync with Atlan, Collibra and Alation (3 Mar). Also Glue Data Quality rule authoring (20 May), SageMaker Data Agent grounded in catalog work context (4 Jun). Also lineage in IAM-based domains (7 Jul), profiling and anomaly checks (18 Aug). - SageMaker Unified Studio release notes, 13 Sep 2026
- "SageMaker Catalog, built on Amazon DataZone" announced as the governance layer of the next generation of Amazon SageMaker. - Amazon press release, 3 Dec 2024
- Amazon DataZone reached general availability on 4 October 2023. It shipped with producer and consumer projects, work glossaries and ML-generated metadata. - AWS News Blog, 4 Oct 2023
Other head-to-heads
DataShield vs Amazon Macie
The AWS answer for finding PII, and the question that lands after it.
DirectDataShield vs Unity Catalog
The other platform catalog, and the same independence argument.
DirectDataShield vs Google Dataplex
Governance bundled with the cloud you happen to be on.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
DataZone catalogs your AWS estate. See what the next layer does. Break a live audit chain. Revoke an agent mid session. Then decide. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →