Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Databricks Mosaic AI: what does the model see before it answers?

Databricks AI Search, once called Mosaic AI Vector Search. It's a good vector database. It does semantic, keyword, and hybrid search. One API, with reranking built in. Sync jobs keep the index fresh on their own. It scales to billions of records. Agent Bricks sits on top. It builds the agent for you. It writes test data, tunes the thing. It ships an agent with little hand work. Your data may already live on Databricks. Then this is the shortest path to a working agent. We'll say so on a sales call.

DataShield isn't a vector database vendor. We run RAG on pgvector, inside a governed data plane you host yourself. Embeddings get made locally, by nomic-embed-text. So no text leaves your walls to become a vector. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Turning a token back is a special, audited step. Each checked tool call lands in a hash chain. You can check it, without asking us. Below is the honest split. Databricks takes several rows.

Get free Demo Center access Get an instant quote
DataShield vs Databricks Mosaic AI at a glanceEight questions regulated buyers ask us. Scored from each vendor's public documentation. DataShield vs Databricks Mosaic AI at a glance Eight questions regulated buyers ask us. Scored from each vendor's public documentation. DataShield Mosaic AI Tamper-evident audit chain you can verify Values tokenized before retrieval Embeddings computed on your own hardware Authority re-checked on every tool call Runs with no vendor control plane Billion-scale serverless retrieval Agent evaluation, judges and auto-tuning Document parsing at enterprise scale shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The text must not leave your building. We embed locally, with nomic-embed-text. Databricks computes managed embeddings for you, or asks for your own vectors. Either way, the boundary moves.
  • You need row and column control on the index itself, not just on the source table. Databricks docs say row and column rules aren't offered on a vector index. They point you at the filter API instead.
  • An examiner will ask you to prove a log wasn't edited. Ours is a SHA-256 chain with signed checkpoints. Break one in your browser, and watch the verifier name the fault. Try it.
  • Your agents also read Postgres, an S3 drop, and a vendor API. One rule plane, and one log, covers all of it. See the architecture.

Pick Mosaic AI when

  • Your corpus is large, and your team is small. Serverless retrieval, at billions of records, with no shard work, is worth real money. We don't offer it.
  • You want the agent quality loop handed to you. Agent Bricks writes test data, runs LLM judges, and tunes the agent. We have no test harness at all.
  • You have a mountain of PDFs. Document Intelligence parses, extracts, and sorts them at scale. Our extraction covers PDF, DOCX, and EML. That's the whole list.
  • You want one bill. AI Search, Agent Bricks, Model Serving, and governance ride on the platform you already bought. Retrieval rates are published, per hour.

Bottom line: Mosaic AI is the fastest way to build a good agent, on data that lives in Databricks now. DataShield proves what that agent was allowed to read, on any platform, with the sensitive values already swapped out. In Databricks shops, we expect to run alongside.

Feature by feature

Competitor cells reflect Databricks' public site and docs, as of the date above. Spot a mistake? Email support@myorg.ai. We'll fix it, and credit you.

What mattersDataShieldMosaic AIEdge
Retrieval engine and scalePostgres pgvector. A 768-dimension chunk table per corpus. Hybrid search unions a keyword leg with the vector leg. Good for a governed corpus. Not built for billions of vectors, and we have no reranker.Serverless hybrid search, over semantic, BM25 keyword, and mixed modes, in one API. Reranking and quality checks are built in. The product page claims it "scales to billions of records and thousands of queries per second". Sync jobs run on top. This is their strongest row, and it's not close.◇
Inside the index: embeddings and permissionsEmbeddings get made locally, by nomic-embed-text. So text never leaves your setup to become a vector. For masked data sets: chunks and embeddings come from the masked view. At index time. The keyword index rebuilds from masked text too. Search can't probe for a redacted value.Databricks-managed embeddings come from a source Delta table. Or you supply your own vectors. On rights, the docs are blunt: "Row and column level permissions are not supported." They say: "implement your own application level ACLs using the filter API." No index-level rule exists.◆
Tokenization and data handlingDatasets get tokenized at ingest. Agents query tokenized data over MCP. Turning a token back is special, and logged. Tokens are fixed, join-safe, and vault-reversible. We also generalize quasi-identifiers. Dates to year, decade, or age band. ZIPs to 3 or 4 digits. Partial phones, SSNs, and emails. Each field gets its own cardinality-reduction score. Masking is a switch you flip.Access rules and lineage sit on governed tables, with guardrails on model traffic. We found no vault-reversible token setup in their public docs. No governed detokenization path, either.◆
What reaches the modelWe don't proxy your LLM traffic. We do gate each value that leaves a checked dataset for a prompt. A PII or PHI column with no set rule gets redacted. It never passes through. A PHI dataset refuses any AI endpoint not marked BAA or ZDR approved.Unity Gateway guardrails let you "Block or Mask PII data such as names, addresses, credit card numbers" in requests and replies. Even for models hosted outside Databricks. The docs mark guardrails Public Preview. They note that "Output guardrails are not supported for embeddings models or for streaming."◈
Agent quality: evaluation and tuningNothing. We don't build test sets, and we don't run LLM judges. We publish no accuracy number, since we have no benchmark to stand behind.Agent Bricks builds task-specific test data, sets judging rules, and auto-tunes agent quality. It uses LLM-as-judge scoring, and human feedback loops. Document Intelligence parses and sorts enterprise documents at scale. Real engineering, honestly earned.◇
Audit evidenceA SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints chain too. Verification returns a named verdict. It tells tampering apart from insertion, deletion, and cut. Ed25519 audit-signing keys stay on your instance, in a key folder you control. Rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. Not a shipped link. Public demo.Usage tracking in system tables. Request and reply logs land in Unity Catalog Delta tables. Detailed, and easy to query. We found no claim anywhere that these records are hash-chained. Or signed, or checked on their own.◆
Agent authorizationEach checked tool call runs a fixed sequence before dispatch. Auth gate, tool narrowing, token scope ceiling, declared access tier. Then a revocation check, then metering. Hand-offs use RFC 8693 token exchange, with a set scope ceiling.Unity Catalog grants on tables, functions, and MCP services. Plus Unity Gateway rate limits and service rules. Managed MCP servers support on-behalf-of user login, with per-server OAuth scopes. A call runs under the requesting user's rights.◆
Break-glassScoped, time-boxed emergency access for agents. Admin plus IP allowlist plus step-up, auto-revoking. It can't be quietly wiped from the log.Not covered in the docs we read. Ask them.◆
GDPR erasureCrypto-shred of the subject's key material. Plus ISO 27560 consent receipts. Actor IDs in the chain are HMAC-committed. The proof still checks out after the subject is gone.Delete the rows, and resync the index. What erasure does to inference tables, audit history, or old embeddings: not spelled out.◆
MCP and agentsMore than 200 MCP tools, across Ontology, Auth, Corpus, and Lighthouse. Auth issues MCP tool tokens with scope ceilings. Per-call counts tie back to the agent that made the call.Five managed MCP servers cover Genie, AI Search, Databricks SQL and Unity Catalog functions. Plus a code interpreter. Custom servers host as Databricks Apps. Outside servers register as MCP Services. The docs mark managed MCP Public Preview.◈
DeploymentSelf-hosted, in your own cloud or data center. Or on a dedicated single-tenant server we run for you. Docker images for Auth, Ontology, Corpus, and Lighthouse. A signed deploy file, which Guardian checks. No vendor control plane in the loop.A Databricks-run control plane, on AWS, Azure, or GCP. Paired with a customer-side data plane. AI Search and Agent Bricks aren't self-hosted. Not open source, either. Not sold on-prem or air-gapped.◆
Maturity and pricingLive in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. Published pricing, and an instant quote, no call needed.A very large private firm. A deep bench. A long compliance record. AI Search rates: published per hour. Standard at 4.00 DBU/hr, Storage Optimized at 18.29 DBU/hr. Worked monthly cases included. Agent Bricks launched in beta in June 2025. Parts of the agent surface still carry Beta labels.◇

◆ DataShield leads◇ Mosaic AI leads◈ comparable

Databricks claims are drawn from databricks.com and docs.databricks.com. Last checked 13 September 2026. We link them below, not just a memory of them.

Three things you get here that you won't get from a platform RAG stack

The index does not hold the secret

Access control on a vector index is a filter. A filter is a request. Tokenize the values first, and the question changes. There's nothing sensitive in the chunk to leak. A bad filter costs you a wrong answer, not a breach notice. Turning a token back is its own admin-tier, tenant-scoped call. The audit write has to succeed, or the lookup gets refused. How the data plane works.

A witness that isn't the defendant

Databricks writes the log. It stores the log in its own Delta tables. It also runs the agent that wrote it. That's fine telemetry. It's not proof. Our chain sits in its own control plane, with its own signing keys. Verification tells deletion apart from truncation and tampering. Edit a record in your browser, and see what happens. Try it, no signup.

Access that can change mid-flight

An analyst quits on a Friday afternoon. Their agent is forty minutes into a retrieval job. With DataShield, the next checked tool call re-checks access, and fails closed. A pulled grant doesn't reach a query running now. How Auth does it.

Where Mosaic AI is genuinely stronger

Start with retrieval, since that's the product. Serverless hybrid search, with reranking built in. Auto sync from the source Delta table. Scale into the billions of records. That's a hard thing to build, and they've built it. No cluster sizing, no shard work, no ETL to keep the index warm. Then Agent Bricks, the part we admire most, and compete with least. Describe the task. It builds test data, sets the judges, and tunes the agent for you. Testing is the bit most RAG projects skip, then regret. Document Intelligence handles the PDF mountain every real setup turns out to have. And the retrieval price is public, per hour, in dollars, with worked cases. That's more than most vendors in this market manage. We won't run the "they hide their pricing" line. It isn't true here.

Here's the push-back, and it's narrow. All that quality work happens after the fact. The sensitive values sit in the index by then. In the embeddings too. In the inference tables too. Unity Catalog governs the source table beautifully. The retrieval index is a copy, and the docs say so plainly. Row and column rules aren't offered there. You're invited to write your own app-level ACLs, with the filter API. That's a reasonable engineering answer, and a poor compliance one. Add guardrails still in Public Preview, that skip embeddings and streaming output. The safety story leans on a lot of unfinished parts. Ours leans on one finished part. The value the model reads is a token. The record of who read it is signed.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on each vendor call, ours too.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes, it can. Each record locks to the one before it. Checkpoints are signed and chained. Verification tells deletion apart from truncation and tampering. Try it at /verify. Databricks: usage lands in system tables, and payloads land in inference tables. Both are easy to query, and detailed. Neither is claimed to be hash-chained or signed, and we went looking. Ask them to show you the integrity proof, not the query.

What happens to a revoked agent mid-session?

DataShield re-checks access on each checked tool call. A pull bites on the very next call. On the Databricks side, managed MCP servers use on-behalf-of user login. A call carries the user's rights. We found no description of a running agent session getting downgraded in flight. Ask how long a compromised agent keeps working after you pull its access.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the subject's key material, and issues an ISO 27560 consent receipt. Actor IDs in the chain are HMAC-committed. The chain still checks out after the subject is erased. Deleting rows from a Delta table is easy. Ask Databricks what erasure does to the vectors already built from that text. And to the inference tables that logged it.

Does row-level security carry into a Databricks AI Search index?

No, and this is the fact worth writing down. The vector search docs say row and column rules aren't offered. They suggest you build your own app-level ACLs, using the filter API. Unity Catalog still governs the source table. The index is a copy, with coarser rules. Our answer is different in kind. We tokenize the value before it's chunked. The index holds a token. Turning it back is its own audited call.

Is DataShield a Mosaic AI alternative for RAG, or does it sit alongside?

Both, depending on your corpus. Need billions of vectors and a reranker? Use AI Search, and put DataShield underneath, for tokenization, per-call access, and evidence. Need a governed corpus on your own hardware? With local embeddings, and no vendor control plane? We can be the whole retrieval path. Our honest limit: free text gets indexed and served raw. Apart from a standing sensitive-pattern chunk filter. So don't load documents whose body text must stay masked. The lakehouse governance case sits next door, in our Unity Catalog comparison.

Does DataShield have SOC 2?

Not yet, and we won't say otherwise. Auth runs live now. It has a public threat model, and a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow. So one small vendor isn't a single point of failure. Details on the security page.

Other head-to-heads

Same market

DataShield vs Elastic

DataShield vs Elastic: Elasticsearch wins retrieval scale and hybrid search. DataShield tokenizes before the.

 Same market

DataShield vs Cortex Search

DataShield vs Snowflake Cortex Search: Cortex Search is fast managed RAG inside Snowflake. We add tokens.

 Same market

DataShield vs Glean

DataShield vs Glean: Glean owns enterprise search and Work AI context across SaaS apps. DataShield tokenizes.

 All

Every comparison

One honest scorecard per vendor, sources at the bottom.

Keep AI Search. Then see what a governed layer adds underneath it. Tokenized values, local embeddings, and an audit chain you can break on purpose. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →