Head-to-head · updated 13 September 2026
DataShield vs Amazon Macie: who governs the data after Macie finds it?
Amazon Macie is good at one job, and honest about it. Turn it on. It scans your S3 buckets. PII, PHI, card data, and AWS credentials. Then it hands you a finding with a severity score. The price sits on a public page: $1 per GB inspected. If you run on AWS, you should probably have it on. We tell prospects that.
Then the ticket lands on someone's desk. Macie says bucket X holds social security numbers. Your RAG pipeline reads bucket X. Now what? That question is ours. Data gets tokenized at ingest. Agents query tokenized data over MCP. Reversing a token is a privileged, audited step. Every call gets checked against the agent's current rights. Each decision seals into a hash chain you can verify yourself.
The short version
Pick DataShield when
- Agents or copilots read the buckets Macie just flagged. You need the access itself governed, not just reported. How Auth does it.
- Your private data also sits in Postgres, Snowflake, a file share, or another cloud. Macie only looks at S3 general purpose buckets.
- An examiner asks you to prove an access log wasn't edited. Macie keeps findings for 90 days. Those are findings, not proof of who did what. Run the verifier.
- You want to pull an agent's rights mid-session and have the next tool call fail. Not wait for a token to expire.
Pick Amazon Macie when
- You need to find private data in S3, and you have no idea where it sits. This is the job Macie was built for. It does it well.
- You are all-in on AWS and want zero new vendors. Macie is a toggle in a console you already pay for.
- You want findings flowing straight into Security Hub CSPM and EventBridge, so a Lambda can act on them.
- You want to model the cost before you commit. $1 per GB inspected, $0.10 per bucket per month. That is open, and most of this market is not.
Bottom line: keep Macie. It finds the data. It does not tokenize it. It does not decide who may query it. It keeps no proof the decision was honoured. That is the layer we sell. It works on data Macie can't see.
Feature by feature: sensitive data discovery versus agent data governance
Competitor cells describe what Amazon Macie's public site says. Also AWS docs. As of the date above. If we've got something wrong, email support@myorg.ai. We'll correct it, credited.
| What matters | DataShield | Amazon Macie | Edge |
|---|---|---|---|
| Sensitive data discovery | We scan, profile and classify a live PostgreSQL source in place. No rows leave it. Columns get labels from 129 field classes. PII, PHI, financial data and secrets. The catalog carries a business glossary, typed lineage and stewardship queues. That is PostgreSQL today, not your whole estate. SaaS apps, cloud stores and endpoints are not ours yet. We've declared other database sources. Not built yet. | Automatic and targeted scanning across the S3 estate. Managed data identifiers, custom regex identifiers, allow lists, sampling. Per-bucket sensitivity scores, too. | ◇ |
| Coverage beyond S3 | Source-agnostic. Data arrives from databases, warehouses, files, and APIs. On any cloud, or none. | Amazon S3 general purpose buckets. AWS docs describe no coverage for RDS, DynamoDB, Redshift. Or SaaS apps, or non-AWS data. | ◆ |
| Tokenization and data handling | Data gets tokenized at ingest. Agents query tokenized data over MCP. Reversing a token is a privileged, audited step. Tokens are deterministic. Join-preserving, too, and vault-reversible. | Discovery and reporting. Macie generates a finding for you to review and remediate. It does not tokenize, vault, or rewrite the data it finds. | ◆ |
| Agent authorization | Every checked call passes a scope ceiling. A declared rights tier, too. A revocation re-check before dispatch. It lands mid session. | No agent identity or per-call authorization. Access control stays with IAM and S3 bucket policy. AWS's agent answer is Bedrock Guardrails. Its PII filter skips tool call arguments and tool results. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Try the verifier. | Findings sit for 90 days. Then they flow onward via EventBridge, if you wire that up. They show no cryptographic tamper proof. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and can't be quietly removed from the log. | Not offered. Not the product's job. | ◆ |
| GDPR erasure | Crypto-shred of per-subject keys, plus ISO 27560 consent receipts. The audit chain still verifies after erasure. | No erasure mechanism. Macie reports where a subject's data sits. Deleting it is your job in S3. | ◆ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings. Plus per-call metering attributed to the agent. | No MCP surface and no agent story. The Macie homepage does not mention AI agents at all. | ◆ |
| Workflow integration | MCP, REST, and API keys. Per-tool tier gating on the Ontology surface. Auth issues MCP tool tokens with scope ceilings. No native Security Hub or EventBridge link today. | Findings publish automatically to EventBridge, and optionally to AWS Security Hub CSPM. A genuinely clean path to a Lambda or a SIEM. | ◇ |
| Deployment | Self-hosted in your own cloud or data center. Or on a dedicated single-tenant server we operate. Your keys. | AWS-managed service, available in most AWS Regions. It runs only inside AWS. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production. (Guardian and Lighthouse since April 2026.) SOC 2 is planned, not attested. We say so. | An AWS service since 2017, rebuilt since, with automated discovery shipped in 2022. It inherits the AWS compliance estate. We won't pretend to match that. | ◇ |
| Pricing | Open pricing, scoped instant quote, no sales wall. | Open per-unit pricing: $1 per GB inspected, $0.01 per 100,000 objects monitored, $0.10 per bucket per month. Plus a 30-day trial. | ◈ |
◆ DataShield leads◇ Amazon Macie leads◈ comparable
Amazon Macie claims come from aws.amazon.com/macie. Also the Macie user guide. Also the Amazon Bedrock Guardrails docs. Last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from a sensitive data scanner
A decision, not a ticket
A finding tells you a bucket holds SSNs. It doesn't stop the agent that reads it an hour later. We check every call against the agent's current scope and rights tier. Then we fail closed. How Auth does it.
Proof that survives an audit
Macie keeps findings for 90 days. Your auditor wants March. Our records form a hash chain with signed checkpoints. The verifier tells you what went wrong, not just that it happened. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred solves that. We destroy the subject's key. The data goes unreadable. The chain still verifies. See the diagram.
Where Amazon Macie is genuinely stronger
Discovery at estate scale is hard, and Macie is good at it. It samples and clusters objects to keep the bill down. It ships managed data identifiers for a long list of countries. It takes your own regex patterns and allow lists. It scores every bucket, so you know where to look first. It posts findings to EventBridge on its own. Also to Security Hub CSPM, if you ask. It does this behind pricing you can put in a spreadsheet. Before you talk to anyone. Most vendors in this market still hide their price behind a form. We like Macie for that alone.
Here is the push-back. Finding data is not governing it. AWS's own docs show where the gap sits. Bedrock Guardrails is the native answer. It keeps PII away from a model. Its sensitive information filter says plainly it checks text only. PII the model writes into tool call arguments. PII in tool results handed back to the model. Tool definitions carry it too. All unblocked. All unmasked. That is the agent path. Its mask mode is also one-way. It replaces a value with {NAME}. Nothing downstream can join on it, or get it back under policy. Our tokens are reversible under audit. A different design, for a different job.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. We sign and chain checkpoints. Verification tells deletion from truncation from tampering. Try it at /verify. Macie stores findings for 90 days and posts them to EventBridge. That is a stream, not a sealed record. AWS shows no tamper-proof method for Macie findings. Ask what your proof looks like on day 91.
What happens to a revoked agent mid-session?
DataShield re-checks rights on every call. Revocation bites on the next call. Macie has no agent concept at all. In AWS the answer is IAM. An IAM change does not reach inside a running agent's plan. Ask how long a compromised agent keeps reading the bucket Macie flagged.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject keys and issues an ISO 27560 consent receipt. The chain HMAC-commits actor identities. So the proof stays verifiable after the subject is gone. Macie tells you where the subject's data is. You delete it. You keep a defensible record of it, too.
Is DataShield an Amazon Macie alternative?
Not really, and we won't sell it that way. Macie is a private-data scanner for S3. We are not a scanner for your existing estate. If your question is "where is my PII," keep Macie. If your question is "who may query it," that is us. Same if you ask "under what rights?" Or "can I prove what happened?" Most AWS customers who buy DataShield leave Macie switched on.
We use Bedrock Guardrails to de-identify data for our agents. Isn't that enough?
It helps, and for free-form prompts it does real work. But the AWS docs are explicit. The sensitive information filter checks text content only. In tool use workloads, it skips tool call arguments. Also tool results, and tool definitions. It also notes that model invocation logs keep the original unmodified request. So the exact place an agent moves a customer record: out of scope. That place is the tool call. We tokenize the dataset at ingest instead. The agent's query never holds the raw value.
Macie only covers S3. What do we do about the rest?
That's the honest gap, and it's in AWS's own docs. Macie inventories S3 general purpose buckets. For Postgres or Snowflake: you need something else. Same for a warehouse, a file share, or another cloud. Ontology ingests from those sources, classifies PII and PHI, and generalizes quasi-identifiers. It serves the result to agents over MCP, with Auth-issued tool tokens. See the architecture.
Does DataShield have SOC 2?
Not yet. SOC 2 is planned, not attested. We won't imply otherwise. AWS obviously has the certificate wall and we don't. What we have: an open threat model. Also a verifier anyone can run. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow. So a small vendor isn't a single point of failure. Details on the security page.
- Macie's positioning, verbatim: "Discover and protect your sensitive data at scale." It runs on machine learning and pattern matching. - aws.amazon.com/macie, 13 Sep 2026
- Macie inventories and analyses Amazon S3 general purpose buckets. It publishes findings to EventBridge and AWS Security Hub CSPM. - Amazon Macie User Guide, 13 Sep 2026
- "Macie stores your policy and sensitive data findings for 90 days." - Amazon Macie User Guide, 13 Sep 2026
- Published pricing: $1 per GB inspected. $0.01 per 100,000 objects monitored per month. $0.10 per S3 bucket per month. Plus a 30-day free trial. - aws.amazon.com/macie/pricing, 13 Sep 2026
- Bedrock Guardrails sensitive information filters check text only. In tool use workloads, they skip tool call arguments. They skip tool results too, and tool definitions. Mask mode replaces a value with its PII type, such as {NAME}. - Amazon Bedrock User Guide, 13 Sep 2026
- Automated sensitive data discovery launched with sampling, object clustering, and per-bucket sensitivity scores. - AWS What's New, 28 Nov 2022
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. - Gartner, 2026
Other head-to-heads
DataShield vs Google Cloud DLP
The other hyperscaler scanner, and the same question after the scan.
DirectDataShield vs Microsoft Presidio
An open-source detector versus a checked, audited access path.
DirectDataShield vs BigID
Discovery across the estate versus enforcement at the tool call.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
Macie finds the data. See what happens next. Break a live audit chain. Revoke an agent mid session. Then decide. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →