Head-to-head · updated 13 September 2026
DataShield vs DataHub: your context graph knows everything. Who tells the agent no?
DataHub began at LinkedIn in 2015, and it shows. The metadata model bends more than the other open catalogs. The lineage runs deep. The connector list tops a hundred sources. People used to call it Acryl Data. Today it calls itself "The Context Platform for AI Agents." It sells a context graph that helps agents answer better. Miro told them accuracy went from about 50% to close to 90%. The core is Apache-2.0, free to self-host forever, with close to 12,700 stars behind it. We won't argue with any of that.
Ours is not a catalog for your whole estate. We scan and tag a live PostgreSQL source in place. That's the honest edge of it. What we add is the part a catalog leaves to you. We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is a locked, checked step. Every governed tool call checks the agent's rights right then. We seal the call into a hash chain. You can check it without trusting us. Here's the split, with rows they win too.
The short version
Pick DataShield when
- Someone will ask you to prove an agent's access log was not edited. An auditor, a checker, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
- You need to pull an agent's rights mid-session. The very next tool call should fail. Not the next token swap. The next call.
- You want tagging, tokenization, agent rights and audit in one self-hosted stack. Not four tools bolted onto a catalog.
- You'd like to see a price before you book a demo.
Pick DataHub when
- You need to catalog the whole estate. A hundred plus links, deep lineage both ways, impact checks. That's their home turf. We're nowhere near it.
- Your problem is an analytics agent giving wrong answers. Context Intelligence and the Context Hub aim right at that. They have a customer count to show you.
- You want an Apache-2.0 core you can fork, read and run forever. A big community and a decade of hyperscale use back it.
- You live on Google Cloud or Snowflake. The Knowledge Catalog sync and the Open Semantic Interchange work are real ties, not just logos on a slide.
Bottom line: DataHub tells your agent what exists and what it means. We decide what the agent may touch, and keep proof of the call. If the job is estate-wide search, buy DataHub. If agents already read regulated data and someone will ask you to account for it, that gap is ours.
Feature by feature
Competitor cells state what DataHub's public site, docs and press say. As of the date above. Did we get something wrong? Email support@myorg.ai. We'll fix it, and credit you.
| What matters | DataShield | DataHub | Edge |
|---|---|---|---|
| Catalog and connector breadth | We add a source over a live link. Then we scan and check its objects and columns in place. No rows leave the source. GA covers PostgreSQL only. Snowflake, BigQuery, Databricks, SQL Server, MySQL, S3, Kafka and Salesforce sit named. No code yet. The config check won't mark them live. | Context Ingestion joins metadata from 100+ sources. Plus semantic terms from dbt and Power BI, and loose in-house notes. This is their strongest row, and the reason most people buy them. | ◇ |
| Lineage | Typed lineage over an edges surface, with four commands and access checks at each end of every hop. It comes from the pipelines that own the ties, not a stored column-level graph. There's no edge-write command, by design. | Fine detail on lineage, both ways. Impact checks too. A metadata graph, proven at LinkedIn and Netflix scale. Deeper than ours. We'd say so on a call. | ◇ |
| Field-level PII and PHI classification | 129 built-in field classes cover PII, PHI, money data and secrets. That's all 18 HIPAA Safe Harbor IDs and eight non-US ID formats. Regex plus checksum checks: Luhn, NPI, Verhoeff, ABA, IBAN, GTIN. Column-name lists and anti-pattern filters too. No model runs here, so calls repeat from a config digest. It went live from shadow mode days ago. That's new, not battle-tested. | Tags, glossary terms and labels you set or pull in. We found no built-in field-class list with checksum checks in their docs. | ◆ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints that are chained too. A check comes back clean, flagged, or tampered. It names the fault as insert, delete, or a cut. Try the verifier demo. | Versioned, timestamped metadata change history. Their v1 release says agents "know why it changed." Their access-rule docs list no tamper-proof method. No signed-proof method either. Ask them for one. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling. A rights tier and a pull check come before dispatch. Then a log runs, and we seal it into the audit chain. Cedar handles admin, config and token calls, not the dispatch hot path. We won't claim otherwise. | The MCP server holds to the access rules. Also the rules already set in your DataHub setup. Platform and metadata rules cover assets, rights and actors. Service accounts can carry a set view that narrows what the server searches. | ◆ |
| Break-glass | Scoped, time-boxed access, just for a crisis, just for agents. Admin and IP-allowlist gated, with step-up. Fully logged and it auto-revokes. | Not listed in their public docs. | ◆ |
| GDPR erasure | Crypto-shred: dropping a person's key row wipes every ciphertext for that person at once. Tied to ISO/IEC 27040 and GDPR Art. 17. Actor names in the chain carry an HMAC lock. The audit still checks out after. We sign ISO 27560 consent receipts at grant and at pull-back. | Soft and hard delete of entities and parts from the metadata graph. No erasure method for the source data, which isn't their job. Nothing like a consent receipt either. | ◆ |
| Tokenization and generalization | Fixed, join-safe, vault-reversible tokens, set at ingest. Plus broad bands for quasi-IDs. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get part masked. Each column gets a risk score. Both are features you switch on, not defaults. | Not a thing they do. A catalog names data. It doesn't change it. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Agents query the governed data itself, under Auth-issued MCP tool tokens with scope ceilings. Per-call logs tie back to the agent. | A real MCP server, and a good one. Search, entity fetch, schema, lineage steps, SQL pull and drafts. Plus edit tools from v0.5.0 for tags, terms, owners and proposals. OAuth2 with open client sign-up. It touches metadata only, never table rows. Block has run it live with Goose since June 2025. | ◈ |
| Prompt egress | We do not proxy your LLM traffic. We do check every value that leaves a governed data set for a prompt. A PHI data set blocks an endpoint with no BAA or a zero-hold deal. | Out of scope. The context graph feeds the prompt. Nothing in it checks what the prompt then carries. | ◆ |
| Deployment and licensing | Self-hosted, in your own cloud or room. Or on a single-tenant box we run for you. Docker images cover Auth, Ontology, Corpus and Lighthouse. Guardian checks a signed deploy file first. Ed25519 audit-signing keys sit on your box, in a key folder you hold. Key turnover uses kid keys. It fails closed on an unknown key. KMS or HSM custody is a built gap in Auth, not a shipped link. HMAC tokenization keys sit as files on your box today, not in a KMS. A paid license, not open code. | Apache-2.0 core you can self-host forever, or DataHub Cloud managed. That license is a real edge. It's why a lot of platform teams never call a vendor at all. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse are live and in use. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet in place, and we say so. Small team, source escrow on design-partner terms. | Project born at LinkedIn in 2015. Firm founded 2021. $65M raised, with a $35M Series B led by Bessemer in May 2025. Netflix, Pinterest, Optum, Miro and Block as named users. Google Cloud and Snowflake ties. | ◇ |
| Pricing | Published price, a quick quote, no sales wall. | Core is free under Apache-2.0, hard to beat. DataHub Cloud is demo-and-quote only. Their price page returns a 404, and every button says "Get a Demo." | ◈ |
◆ DataShield leads◇ DataHub leads◈ comparable
DataHub claims come from datahub.com, docs.datahub.com and DataHub's own news posts, last checked 13 September 2026. We link them below, not just from memory.
Three things you get here that you won't get from a metadata catalog
Proof that survives an audit
A log an admin can quietly edit proves nothing. Ours is a hash chain with signed checkpoints. The verifier names what broke. It answers clean, flagged, or tampered. It tells insert apart from delete and a cut. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Authority that can change mid-flight
An analyst quits on a Friday. Their agent is 20 minutes into a 40 minute job. With DataShield, the next governed tool call checks live rights and fails closed. Edit a catalog rule instead. You wait for the agent's token to come round again. How Auth does it.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred settles it. We wipe the person's key parts. The data goes unreadable. The chain still checks out. See the diagram.
Where DataHub is genuinely stronger
We'd rather you heard this from us. DataHub has ten years of hyperscale use behind it. An Apache-2.0 license you can read line by line. The connector list runs past a hundred sources. The lineage and impact checks run deeper than ours, and will stay that way. Their 2026 has been strong. A Google Cloud tie-up in April syncs both ways with Knowledge Catalog. They took a seat at Snowflake's Open Semantic Interchange. DataHub Cloud v1 launched in May. Four context tools came with it. A Miro accuracy number too. Their MCP server is not a demo either. Block has run it with Goose since June 2025. It now has edit tools and OAuth2. It stays careful, and never touches table rows. Is your problem that nobody knows what your data means? Call them, not us.
Here's the push-back. Context makes an agent smarter. It doesn't make an agent safe. The MCP server holds to the rules you already set in your DataHub setup. That's the right build for a catalog. A thin answer for a regulated shop. Their docs list versioned change history. That tells you what a record looks like now, and looked like before. They don't list a way to prove this: that nobody edited the record of what an agent did. And the agent still queries the warehouse on its own keys. Nothing from DataHub sits in that path. Gartner expects most bad agent moves through 2028 to be inside jobs, not outside attacks. That's the case where better context helps not at all. The agent knew plenty, and still did the wrong thing.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record ties to the one before it. We sign and chain checkpoints. The check tells delete apart from a cut and from a tamper. Run it against a sample chain at /verify. DataHub: their docs cover versioned metadata history and access rules. We found no tamper-proof method in them. Ask to see one, and ask who can write to the database under it.
What happens to a revoked agent mid-session?
DataShield re-checks rights on every governed tool call. Revocation lands on the next call. DataHub's MCP server holds to the rules set in your setup. Service accounts can carry a view that narrows what they search. We found no listed mid-session revoke path. Ask how long a bad agent keeps working after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the person's key parts and sends an ISO 27560 consent receipt. Actor names in the chain carry an HMAC lock. The proof still checks out. Even once the person is gone. DataHub can soft or hard delete entities and parts from the graph. That removes metadata, not the data itself. The erasure story for the source system stays yours to solve.
We already run DataHub Core. Do we rip it out?
No. If it's cataloging a hundred sources for you, keep it. Run us on the data sets agents actually read. The job there is tagging, tokens, rights and proof, not a full list. The overlap is smaller than it looks. We are PostgreSQL today. Not your whole estate. We have no view on your Kafka topics. Plenty of teams will run both, and rightly so.
DataHub ships an MCP server too. What's different?
Theirs hands an agent metadata: search, schemas, lineage, past SQL. Since v0.5.0, it can also edit tags and terms or file a proposal. It never touches table rows, a deliberate and good call. Ours is where agents query the governed data itself. The tool token carries a scope ceiling. We check the call before dispatch. We seal the call into the chain. Two different jobs. Use theirs to ask what a table means. Use ours to read the table under a rule you can later prove.
Does DataShield have SOC 2?
Not yet, and we won't say otherwise. Auth is live with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run live since April 2026. We have no SCIM link either, which matters if you were counting on one. Design-partner terms include source escrow. One small vendor is not a single point of failure. Details on the security page.
- DataHub's current positioning: "The Context Platform for AI Agents", with a hero promise of "Your context graph, unified with lineage, quality, and real-time context for every agent to rely on." - datahub.com, 13 Sep 2026
- DataHub Cloud v1: Context Ingestion across 100+ sources, Context Intelligence, Context Hub and Context Activation; Miro reports analytics-agent accuracy moving from close to 50% to around 90%. - DataHub news, 28 May 2026
- The DataHub MCP server exposes search, lineage traversal, schema inspection, SQL drafting and, from v0.5.0, metadata mutation and proposals; it accesses metadata only and never exposes table data. - docs.datahub.com MCP feature guide, 13 Sep 2026
- DataHub access policies cover platform and metadata privileges over resources and actors. Their docs describe no tamper-evident or cryptographic audit mechanism. - docs.datahub.com authorization policies, 13 Sep 2026
- Block runs the DataHub MCP server with its open-source Goose agent across 50+ data platforms for incident response, discovery and impact analysis. - DataHub blog, 3 Jun 2025
- $35M Series B led by Bessemer Venture Partners, bringing total funding to $65M; DataHub Core remains Apache-2.0 with roughly 12,700 GitHub stars. - DataHub news, 20 May 2025; GitHub, 13 Sep 2026
Other head-to-heads
DataShield vs OpenMetadata
The other open catalog, and the same missing enforcement seam.
OSS catalogDataShield vs Amundsen
Search and discovery for humans, versus authority for agents.
Platform catalogDataShield vs Unity Catalog
Governance inside one platform, versus evidence across them.
AllEvery comparison
One honest scorecard per vendor.
See both moves run in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your catalog still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →