Head-to-head · updated 13 September 2026
DataShield vs Dagster: the pipeline ran, but was the agent allowed?
Dagster earned its following. It flipped orchestration on its head. The data asset is the unit of work now, not the task. You declare what should exist. Dagster works out what to run. Then it tracks lineage, freshness, and failures for you. The asset graph beats a task DAG as a mental model. Plenty of good teams will tell you so. One thing to know before you sign: on 13 July 2026, Prefect said it was buying Dagster Labs. From August, the combined firm trades as Prefect. Dagster and Dagster+ keep their names. The open-source license stays the same.
We are not an orchestrator. DataShield doesn't schedule your jobs, and won't pretend to. We govern the data agents read, after the pipeline does its work. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, audited step. Each checked tool call gets re-checked against the agent's current access, right before it runs. Each decision seals into a hash chain you can verify, without trusting us. Most of our buyers keep their orchestrator. Here's the honest split, rows Dagster wins included.
The short version
Pick DataShield when
- An examiner will ask you to prove an agent's access log wasn't edited. Article 12 of the EU AI Act asks it. HIPAA §164.312(b) asks it too. Our chain answers with math, not a policy PDF. Run the verifier.
- You need to pull an agent's access mid-job. The very next tool call should fail. Not the next token refresh. The next call, right then.
- The columns an agent reads must be tokenized or generalized first. Someone has to hold the keys. That someone is you.
- The data plane, the rule engine, and the evidence all have to run on your own kit. No control plane calling home.
Pick Dagster when
- You need an orchestrator. That's the whole job here, and it's not one we do. Asset-oriented scheduling, backfills, retries, partitions, sensors: all theirs.
- You want lineage and freshness across your whole stack, tools we never touch included. Their asset graph spans dbt, Snowflake, Spark, and the rest.
- SOC 2 Type II matters on paper this quarter. Their pricing page lists it on every tier, with HIPAA and SCIM higher up. We have none of the three. We won't pretend we do.
- You want a managed control plane, with a data plane in your own cluster. Their September 2026 hybrid write-up on Kubernetes and Azure is a real, deep answer.
Bottom line: Dagster makes the asset. DataShield decides what an agent may do with it, and keeps proof of that call. Run both. If agents already read production data, the proof gap bites first.
Feature by feature
Competitor cells reflect Dagster's public site, docs, and blog, as of the date above. Spot a mistake? Email support@myorg.ai. We'll fix it, and credit you.
| What matters | DataShield | Dagster | Edge |
|---|---|---|---|
| Pipeline orchestration | We ingest, transform, snapshot, and watch storage on a schedule. That's dataset plumbing, not orchestration. No DAG engine, no backfills, no partitions, no sensors. | The core product, and a good one. Software-defined assets, declarative automation, retries, partitions, run history, cross-tool asset graphs. | ◇ |
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints chain too. Verification names the exact fault: tampering, insertion, deletion, or cut. Try the verifier. | Run history, asset materialization history, and audit logs on the upper tiers. We found no published tamper-proof method in their docs. | ◆ |
| Agent authorization | Each checked tool call carries a scope ceiling, an access tier, and a revocation check before dispatch. Then it gets metered, and tied to the agent. It fails closed. | Compass, their text-to-analytics Slack app, runs on private Slack channels, a table allowlist, and pull requests to a config repo. That's a perimeter, not a per-call decision. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, gated by admin plus IP allowlist plus step-up. It auto-revokes, and can't be quietly wiped from the log. | Not covered in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Delete the subject key, and each cipher record for that person goes dark at once. The chain still verifies. | GDPR is listed on every pricing tier, with data portability. The erasure method itself isn't spelled out. Fair, since an orchestrator doesn't own your rows. | ◆ |
| Tokenization and masking | Tokens are fixed, join-safe, and vault-reversible, set at ingest. We also generalize quasi-identifiers. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking. Each field gets its own cardinality-reduction score. Turning a token back is privileged, and logged. | Not a feature. You'd write it yourself, as a pipeline step. Then you own the keys, the vault, and the audit. | ◆ |
| PII and PHI classification | 129 field types cover PII, PHI, financial data, and secrets. Regex plus checksum checks (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), a column-name list, and anti-patterns. No model, so results repeat from a config digest. All 18 HIPAA Safe Harbor markers are their own class. It moved off shadow mode this month, so it's new, not battle-worn. | Their July 2026 case study sorted a million Snowflake columns in nine days, with an LLM. Read it closely: that's a pipeline a customer built on Dagster, not a sorter Dagster ships. | ◆ |
| Catalog and lineage | A real catalog over live links: in-place scan and profiling, no rows leaving the source. A glossary, typed lineage you can trace, access checked at each hop, and a 29-step steward workflow. PostgreSQL today, not your whole estate. Other sources are planned, not built. | Asset catalog and lineage across every tool the orchestrator touches, plus freshness and health. Wider reach than ours, by a wide margin. It comes free with the pipelines. | ◇ |
| MCP and agents | More than 200 MCP tools, across Ontology, Auth, Corpus, and Lighthouse. MCP tool tokens carry scope ceilings. Hand-offs use RFC 8693 token exchange, with a set ceiling. Each call gets metered, and tied to the agent. | The marketing says AI-native. Dagster+ AI reasons over run and lineage context. We couldn't find an MCP server in their public docs. Worth asking them straight. | ◆ |
| Deployment | Self-hosted, in your own cloud or data center. Or on a dedicated single-tenant server we run for you. Docker images for Auth, Ontology, Corpus, and Lighthouse, with a signed deploy file Guardian checks. Ed25519 audit-signing keys stay on your instance, in a key folder you control, with rotation that fails closed on an unknown key. KMS or HSM custody is a built seam in Auth, not a shipped link. HMAC tokenization keys sit in your setup, or derive from your machine key today. Not in a KMS. | Open-source Dagster runs anywhere. Dagster+ Serverless is fully managed, while Dagster+ Hybrid puts the agent, code servers, and run workers in your cluster. Dagster Labs keeps the control plane. | ◈ |
| Open source | Not open source. Design-partner terms include source escrow, so one small vendor isn't a single point of failure. | Dagster Core is open source, self-hosted at no license cost, with a large community. The acquisition page says the license won't change. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse run live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. No SCIM link either. | Founded 2018. Big open-source community, big-name logos. SOC 2 Type II and GDPR on every tier, HIPAA on Pro and Enterprise. Now merging into Prefect. That's the one open question. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Also published, which is rarer than it should be. Solo and Starter list prices. Pro and Enterprise on request. Billing runs per credit. A credit is one asset run or one op run, plus serverless compute per minute. | ◈ |
◆ DataShield leads◇ Dagster leads◈ comparable
Dagster claims are drawn from dagster.io, its pricing page, and its own blog. Last checked 13 September 2026. We link them below, not just a memory of them.
Three things you get here that you won't get from an orchestrator
Proof that survives an audit
Run history tells you a job worked. It doesn't tell a regulator nobody edited the record. Ours is a hash chain with signed checkpoints. The verifier says what broke: tampering, insertion, deletion, or cut. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers check for. Try it in your browser, no signup.
Access that can change mid-flight
An analyst quits at 4pm on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, the next checked tool call re-checks current access, and fails closed. A Slack channel with the wrong people still in it doesn't. How Auth does it.
Columns that are safe before the model sees them
Tokenize at ingest, and the agent joins on TOK_ values it can never reverse. Turning a token back is a separate, privileged, logged call. It's tenant-scoped, so an admin can't reach another tenant's vault. See the data plane.
Where Dagster is genuinely stronger
We'd rather you heard this from us. The asset model is good engineering. Declaring what should exist, and letting the system work out the runs, beats wiring tasks by hand. The lineage and freshness you get as a side effect are real. Their September 2026 hybrid post reads like people who've actually run this in someone's Azure tenant. Node pools, GitOps, workload identity, who owns which boundary. The open-source core is real, the community is large, and the pricing sits right on the web page. On compliance paper, they beat us today. SOC 2 Type II on every tier, HIPAA higher up, SCIM and SSO where you'd expect. We have none of that yet, and we won't fudge it.
Here's the push-back, and it's about Compass. Point a language model at your warehouse tables. Let people ask questions in Slack. Govern it with channel membership, plus a table allowlist, plus pull requests to a config repo. Each of those controls sits at the edge, set before anyone asks anything. None of them re-checks at the moment of the query, and none can pull someone mid-answer. None gives you a record an examiner can check on its own. Gartner expects most unauthorized agent transactions through 2028 to be internal policy slips, not attacks. That's exactly the case a Slack channel handles worst. That gap is the layer we sell. It sits fine under an orchestrator.
Questions worth asking both of us
These are the questions we'd want answered if we were the ones buying. Ask them on each call, ours too.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, it can. Each record locks to the one before it. Checkpoints are Ed25519-signed, and chained. Verification tells deletion apart from truncation and tampering. Run it against a sample chain at /verify. Dagster: their upper tiers list audit logs, and run history is rich. We found no tamper-proof method in their docs. Ask them what stops a database admin from editing a row.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. Revocation lands on the very next call, not the next token refresh. Dagster: we couldn't find a mid-session revocation story. For Compass, the nearest control is dropping someone from a Slack channel. Ask how long a compromised login keeps getting answers, after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the per-subject key. That wipes each cipher record for that person at once. Then it issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still checks out once the subject is gone. Dagster lists GDPR support on every tier. What that means for rows inside your warehouse, and for run history that quotes them, is yours to work out. Ask for the mechanism, not the badge.
Does DataShield replace Dagster?
No. Need an orchestrator? Buy an orchestrator. We have no DAG engine, no backfills, no partitions, and no sensors. Nothing on our roadmap says otherwise. The normal shape: Dagster builds the assets, DataShield governs the datasets your agents then read. Classification, tokenization, per-call access, and the audit chain. Two layers, one handshake.
Dagster is merging into Prefect. Should that change my decision?
Probably not this quarter, but ask about it. The 13 July 2026 announcement says deployments, contracts, pricing, and support stay unchanged. The open-source license stands. The combined firm runs as Prefect from August 2026. Fine. The real question is the three-year one. When two orchestrators sit under one roof, which one gets the roadmap? What does migration look like, if the answer isn't yours? Get it in writing. We also wrote up the Prefect side of this.
Does DataShield have SOC 2?
Not yet, and we won't say otherwise. Dagster does, on every tier. If that's a hard gate for you this quarter, this is an easy call. What we offer instead: a published threat model, a verifier anyone can run, and design-partner terms with source escrow. Auth runs live now. Guardian and Lighthouse have run since April 2026. Details on the security page.
- Prefect is acquiring Dagster Labs. Announced 13 July 2026, closing August 2026, with the combined company operating under the Prefect name from August 2026. Dagster and Dagster+ stay supported and the open-source license is unchanged. - dagster.io/prefect, 13 Sep 2026
- Current hero positioning: "AI-native DataOps platform" and "Data your team trusts. AI that runs on it." - dagster.io, 13 Sep 2026
- Pricing is published: Solo and Starter list prices with Pro and Enterprise on request. A credit is the sum of asset materializations and ops executed, plus serverless compute per minute. SOC 2 Type II and GDPR on all tiers, HIPAA on Pro and Enterprise. - dagster.io/pricing, 13 Sep 2026
- Dagster+ Hybrid: the customer's cluster runs the agent, code servers and run workers while Dagster Labs operates the control plane. - Dagster blog, 8 Sep 2026
- Compass governance as described by Dagster: private Slack channels, configuration to read only specific warehouse tables, and pull requests to the project repo for context changes. - Dagster blog, 1 Jun 2026
- Column classification at scale was a customer-built pipeline on Dagster, not a shipped Dagster feature: "Classifying a Million Snowflake Columns in 9 Days, Solo, with Dagster." - Dagster blog, 16 Jul 2026
Other head-to-heads
DataShield vs Prefect
The other half of the merger, and the same missing layer.
TransformDataShield vs dbt Labs
Models and tests, versus authority at the tool call.
IngestDataShield vs Fivetran
Pipes that move the data, and the plane that governs it.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask what your orchestrator still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →