Head-to-head · updated 13 September 2026
DataShield vs data.world: who owns the catalog now that ServiceNow does?
data.world spent nine years building an enterprise data catalog on a knowledge graph. It shows. Search is good. The glossary is good. Stewards like living in it. Their hero line is "Turn data chaos into clarity." On a large messy estate, they often do. They also ship a real MCP server, hosted at api.data.world/mcp. It uses browser consent, and a scoped token that expires in 30 days. That's a serious product. We won't pretend otherwise.
One thing changed in May 2025. ServiceNow bought them. The data.world press room has posted nothing since. ServiceNow's own May 2026 launch names "ServiceNow Data Catalog" and "Context Engine". It never says data.world once. So the real question isn't catalog versus catalog. It's where the metadata about your regulated data lives. And who can prove what an agent did with it. We run the catalog, the classification, the agent authorization, and the audit chain. All inside your own walls. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, audited step.
The short version
Pick DataShield when
- The catalog must not live in someone else's cloud. Ours is self-hosted in your own cloud or data center, or a dedicated single-tenant server we run.
- Someone will one day ask you to prove an agent's access log wasn't edited. Our chain answers with math, not a policy PDF. Run the verifier.
- You need to pull an agent's access mid-session. The very next checked tool call should fail. Not the next token refresh.
- You don't want your data catalog to be a line item on your ITSM vendor's platform contract.
Pick data.world when
- You need to catalog the whole estate today. Their connector coverage is wide. Ours isn't, yet.
- You already run ServiceNow. The catalog is folding into Workflow Data Fabric. One bill with one vendor is a real plus.
- Business users will do the curating. Their search and glossary work suits analysts. Nine years of polish is hard to beat.
- You want the knowledge graph itself. It's genuinely good. A private graph built over a decade isn't something you rebuild in a quarter.
Bottom line: most teams should run both. data.world tells an agent what a column means. DataShield decides whether that agent may read it, and keeps proof of the call. Think harder only when the metadata itself is sensitive, and you'd rather it never left your building.
Feature by feature
Competitor cells reflect data.world's public site, docs, and ServiceNow's press releases. As of the date above. Spot a mistake? Email support@myorg.ai. We'll fix it, and credit you.
| What matters | DataShield | data.world | Edge |
|---|---|---|---|
| Catalog coverage | We register a source over a live link. We scan it, and profile assets and columns in place. No rows leave the source. That's PostgreSQL today. Snowflake, BigQuery, Databricks, SQL Server, S3, Salesforce, and Kafka are planned, with no handler built yet. We publish that list, rather than hide it. | Wide connector coverage, across warehouses, BI tools, and SaaS, with on-site collectors. This is the row they win, and it's not close. | ◇ |
| Knowledge graph and glossary | A business glossary built from entity types, shaped to ISO/IEC 11179. Plus typed lineage you can trace, with access checked at each hop. The lineage comes from the pipelines that own it, not a separate graph database. We say so. | A private knowledge graph is the whole build. Nine years of it. They claim "4.2x more accurate insights" from it. The method behind that figure isn't published, though. | ◇ |
| Field classification | 129 built-in field types cover PII, PHI, financial data, and secrets. All 18 HIPAA Safe Harbor markers are included. Regex plus checksum checks, column-name lists, and anti-pattern rules. No model, so results repeat from a config digest. Scans store no column values by default. | Sensitivity tags and rule flows sit on the catalog. We found no published class count, and no checksum checks. No word, either, on whether sample values get stored. | ◆ |
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints chain too. Verification returns one of three verdicts: clean, attested damage, or tampered. It names the fault. Try the verifier. | Governance flows and activity history. ServiceNow's own May 2026 launch says agents today link to data sources with "no audit trail". It offers a registry as the fix. We found no cryptographic tamper proof in either firm's material. | ◆ |
| Agent authorization | Each checked tool call carries a scope ceiling. It carries an access tier, and a revocation check, before dispatch. Metering runs before the handler. The call fails closed. | The MCP server issues a scoped token after a browser consent screen. That's good practice. We found no per-call authorization step, and no mid-session revocation. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes, and is IP-allowlisted and step-up gated. It can't be quietly wiped from the log. | Not covered in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed. The evidence still checks out after the subject is gone. | Governance and policy flows. The erasure method underneath isn't spelled out in their docs. | ◆ |
| Tokenization | Tokens are fixed, join-safe, and vault-reversible, set at ingest. We also generalize quasi-identifiers. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking. Each field gets its own cardinality-reduction score. Masking and generalization are switches you flip, not defaults. | Not part of the product. A catalog describes data. It doesn't change it. | ◆ |
| MCP and agents | More than 200 MCP tools, across Ontology, Auth, Corpus, and Lighthouse. Auth issues MCP tool tokens with scope ceilings. Hand-offs use RFC 8693 token exchange, with a set ceiling. | A documented MCP server at api.data.world/mcp, fully hosted by them. OAuth consent, and a 30-day scoped token. Self-hosting it is not on offer. | ◈ |
| Deployment | Self-hosted, in your own cloud or data center. Or on a dedicated single-tenant server we run for you. Docker images ship for Auth, Ontology, Corpus, and Lighthouse, with a signed deploy file Guardian checks. Ed25519 audit-signing keys stay on your instance, in a key folder you control. Rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth, not a shipped link. HMAC tokenization keys live in your setup today. Not in a KMS. | SaaS, now on ServiceNow's platform. On-site collectors gather metadata, but the catalog itself is hosted. We found no self-hosted edition. | ◆ |
| Maturity and reach | Auth, Guardian and Lighthouse run live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. We're small. | Founded 2016, roughly $350M valuation at the 2022 Series C. Bought by ServiceNow in May 2025. Now sold by one of the largest enterprise sales forces on earth. Public-sector credentials include an AFWERX SBIR and Tradewinds "Awardable" status. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Quote only, and always has been. A free community tier exists. Expect the paid side to shift toward ServiceNow platform pricing. | ◆ |
◆ DataShield leads◇ data.world leads◈ comparable
data.world claims are drawn from data.world, docs.data.world, the data.world press room, and ServiceNow newsroom releases. Last checked 13 September 2026. We link them below, not just a memory of them.
Three things you get here that you won't get from an enterprise catalog
A catalog that never leaves the building
Metadata about regulated data is regulated data. Column names, glossary terms, and sensitivity labels tell an attacker right where to dig. Ours runs on your own hardware, with your keys. It works with no outbound call. How it's put together.
Access that can change mid-flight
An analyst quits at 4pm on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, the next checked tool call re-checks current access, and fails closed. A catalog would have logged the whole run, and told you on Monday. How Auth does it.
Proof that survives an audit
A log you can quietly edit proves nothing. Ours is a hash chain with signed checkpoints. The verifier tells you what broke, not just that something did. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Where data.world is genuinely stronger
Start with the graph. data.world bet on a knowledge graph in 2016. Well before it was fashionable. They stuck with it. That bet paid off, in search quality. Also in how well the glossary holds together across a big estate. Their connector list is long. Their on-site collectors work. Analysts actually enjoy the product, which is rare in this category. The AI Context Engine launched March 2024. It got to "chat with your data" a year ahead of most catalogs. Their MCP server is real, documented, and sensibly built. Browser consent, a scoped token. The AI client never sees your password. And now ServiceNow sells it. If your estate is sprawling, and your buyer is the CDO, that mix is hard to argue with. We wouldn't try.
Here's the push-back. ServiceNow's own May 2026 launch states the problem plainly. AI agents connect to data sources "with no central oversight, no approval workflow, and no audit trail." Their answer: a registry and a gateway, inside ServiceNow. It governs agents that they also supply. That's a reasonable answer for a ServiceNow shop. It's a poor answer, if you want independent evidence. Same, if the agent you need to check wasn't bought from them. There's also a quieter issue. data.world has posted no press release of its own, since the deal. ServiceNow's 2026 materials don't use the name at all. Brands get absorbed. Ask what your renewal looks like in three years. Ask whether the catalog you're buying will still be sold on its own.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on each call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, it can. Each record locks to the one before it. Checkpoints are signed with Ed25519, and chained to each other. Deleting a checkpoint shows up too. Verification returns clean, attested damage, or tampered. It tells deletion apart from truncation. Try it at /verify. data.world: we found rules and activity history, but no tamper-proof method in their docs. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. Revocation lands on the next call, not the next token refresh. data.world's MCP tokens are scoped. They expire after 30 days. We couldn't find a mid-session revocation path. Ask how long a compromised agent keeps working, after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the subject's key material, and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed. The evidence still checks out once the subject is gone. data.world describes governance policy flows. The mechanism under it isn't published. Ask for the mechanism, not the flow.
Is DataShield a data.world alternative, or do we need both?
Be honest with yourself about the estate. Need to catalog forty source systems next quarter? Buy theirs. Ours scans and profiles a live PostgreSQL source in place today. Other source types are planned, not built. Where we replace them is a narrower job: the datasets agents actually touch. There you need classification, tokenization, per-call access, and evidence, in one deployable stack. Plenty of teams will run both. That's a fine answer.
data.world is a ServiceNow product now. Does that matter?
It depends on what you already own. If ServiceNow runs your service desk, this is a gift. One vendor, one contract. A catalog wired into Workflow Data Fabric. If it doesn't, you're buying a catalog whose roadmap now serves someone else's agent platform. Two facts worth weighing. data.world has posted no press release of its own, since the May 2025 deal. ServiceNow's May 2026 launch talks about "ServiceNow Data Catalog", and never mentions the name data.world.
Does DataShield have SOC 2?
Not yet, and we won't say otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow, so one small vendor isn't a single point of failure. Details on the security page.
- data.world's current positioning: "The enterprise data catalog data teams trust in the AI era - now by ServiceNow," with a "4.2x more accurate insights" knowledge-graph claim. - data.world, 13 Sep 2026
- ServiceNow announced its acquisition of data.world on 7 May 2025, two months after buying Moveworks for $2.85B. Terms undisclosed; data.world was valued at about $350M at its 2022 Series C. - TechCrunch, 7 May 2025
- ServiceNow's data launch names "ServiceNow Data Catalog" and "Context Engine". It states that AI agents connect to services, MCP servers and data sources "with no central oversight, no approval workflow, and no audit trail." - ServiceNow newsroom, 6 May 2026
- The data.world MCP server is "fully hosted by data.world" at https://api.data.world/mcp, uses browser-based OAuth consent, issues a scoped token valid for 30 days, and never gives the AI client the user's password or access token. - docs.data.world, 13 Sep 2026
- The AI Context Engine launched in March 2024 and was productised in May 2024 as "Chat with your data." The press room's most recent entry predates the ServiceNow acquisition. - data.world press room, 13 Sep 2026
- data.world pricing is quote-only, with no published tiers for paid enterprise plans. - Capterra vendor listing, 13 Sep 2026
Other head-to-heads
DataShield vs Collibra
Governance at enterprise scale, versus enforcement at the tool call.
CatalogDataShield vs Alation
Search and stewardship, and the evidence layer underneath.
CatalogDataShield vs Atlan
A modern metadata plane, versus a governed data plane for agents.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Then revoke an agent mid-session. Decide what your catalog still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →