Head-to-head · updated 13 September 2026
DataShield vs Elastic: great retrieval, but what actually reaches the model?
Elastic calls itself "The Search AI Company". Its hero line is "Better retrieval. Better answers." They've earned it. One engine does BM25 keyword search. Also dense vectors. Their own sparse encoder, and hybrid ranking. It runs over the same index. One that already holds your logs. Agent Builder is GA. It ships a real MCP server. Claude Desktop or Cursor can call it today. If retrieval quality at scale is your problem: Elasticsearch answers it well. We won't pretend otherwise.
Search is not our engine to run. We are the checked layer. Under the retrieval instead. We tokenize datasets at ingest. Agents then query tokenized data over MCP. Turning a token back into real data. A privileged step. It's audited every time. Embeddings run locally too, with nomic-embed-text. Nothing leaves to become a vector. We re-check each checked tool call. Against the agent's current access. That happens right before it runs. We then seal the call into a hash chain. You can verify it, without trusting us. Here is the honest split. It includes the rows Elastic wins outright.
The short version
Pick DataShield when
- The PII must be gone before the prompt is built. Not filtered out after retrieval. Tokens go in at ingest. A fail-closed gate redacts any PII column with no configured treatment.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Run the verifier.
- You need to pull an agent's access mid-session. The very next tool call should fail. Not the next key rotation. The next call.
- Embeddings must be computed inside your walls. Ours run locally on
nomic-embed-text. No vectorization call leaves the box.
Pick Elastic when
- Retrieval quality across a big, messy estate is the actual problem. Keyword, dense vector, sparse vector and hybrid ranking, all in one engine. That's a real advantage. Ours is narrower.
- You already run Elasticsearch for logs or security. Adding an agent over an index you've tuned for years beats a second data plane. No need to stand one up.
- You want 300+ integrations, and 60 cloud regions. From a public company, with a support SLA. We are a small team. We say so.
- Your search workload needs the engineering Elastic put into vector performance. That includes Better Binary Quantization, on by default since 9.1.
Bottom line: Elastic decides what is relevant. We decide what the agent may do with it. We keep raw values out of the prompt. We keep proof of the decision too. Most buyers who talk to us keep their index. They just add the layer underneath.
Feature by feature
Competitor cells describe what Elastic's docs and pricing pages say. Press releases too. We use the date above. If we got a fact wrong, email support@myorg.ai. We'll correct it, and credit you.
| What matters | DataShield | Elastic | Edge |
|---|---|---|---|
| Retrieval engine | Hybrid retrieval on Postgres. A tsvector keyword leg. And a pgvector leg: 768-dimension vectors. Per-corpus chunk tables. Built at index time. Good for checked data sets. Not a search platform. Not for your whole estate. | The strongest row on this page. For them. BM25, dense kNN, their learned sparse encoder. Reciprocal Rank Fusion hybrid ranking. All in one engine. Better Binary Quantization is on by default since 9.1. | ◇ |
| Embeddings | nomic-embed-text runs locally in your deployment. No embedding call leaves the network. That matters. Especially when the text is clinical notes. | Elastic Inference Service. Plus third-party model providers. Billed per million tokens. Their own encoder can run in-cluster. On paid ML nodes. Vectorizing through a hosted service is the default path. | ◆ |
| Data handling before the model | Deterministic, join-preserving, vault-reversible tokens. Applied at ingest. Plus quasi-identifier generalization. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking. Each column gets a measured cardinality-reduction score. We don't proxy your LLM traffic. We gate each value that leaves a checked data set. For a prompt. A PHI data set refuses an endpoint. Without a BAA. | Document- and field-level security filters something. What a role may read. At query time. Values that pass the filter reach the prompt. As written. Tokenization is not vocabulary Elastic uses. | ◆ |
| Permission-aware retrieval | Authorization is a per-call decision. It runs on the agent's live context. Not a query filter. Not one baked into a role. Chunk views also mask at read time. They rebuild the keyword index. From the masked text. Search can't be used as a probe. Not for a redacted value. | Real, and widely used. But it's Elasticsearch roles and API keys. Their own DLS docs concede that users "can still craft searches revealing aggregate data, field names, and term counts from inaccessible documents." That's an inference channel, in writing, from the vendor. | ◆ |
| Agent authorization | Each checked tool call passes a scope ceiling. Also a consented-tool allowlist. Plus an access tier. And a mid-session revocation re-check. That's all before dispatch. It fails closed. | Agent Builder docs say to "configure security roles and API keys to control who can use agents, which tools they can access, and what data they can query." That's configuration at setup time. We found no per-call re-check. | ◆ |
| Audit evidence | A SHA-256 hash chain. With Ed25519-signed checkpoints. Those checkpoints are themselves chained. Verification returns one of three verdicts. Clean, attested damage, or tampered. It names the row that broke. Try it on a sample chain. | Elasticsearch logs. Kibana has an activity view. We found no tamper-evidence claim. Nothing about audit logging, either. Not in the Agent Builder docs. | ◆ |
| Break-glass | Scoped, time-boxed emergency access, just for agents. It auto-revokes on its own. It's IP-allowlisted and step-up gated too. It can't be quietly removed. Not from the log. | Not in their public material at all. | ◆ |
| GDPR erasure | Crypto-shred: delete the subject key. Each ciphertext for that subject goes unreadable. All at once. ISO 27560 consent receipts. Signed at grant and at withdrawal. The audit chain still checks out afterwards. | Delete by query. Index lifecycle policies. And reindexing. Nothing said about erasure. Not what it does to an embedding. One already computed from deleted text. | ◆ |
| MCP and agents | More than 200 MCP tools. Across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens. With enforced scope ceilings. It meters each call. Against the agent that made it. Ontology's MCP surface authenticates with tiered API keys. We'd rather say that than imply otherwise. | Agent Builder GA. With a built-in MCP server. External clients work too. Claude Desktop and Cursor, for instance. External MCP tools are importable too. Plus an A2A server. Shipped and priced. Not a roadmap slide. | ◈ |
| Deployment | Self-hosted. In your own cloud or data center. Or a dedicated single-tenant server we operate. Docker images for Auth and Ontology. Corpus and Lighthouse too. A signed deploy manifest that Guardian verifies. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Keys rotate by kid. It fails closed on an unknown key. KMS custody is a built seam in Auth. So is HSM. It's not a shipped integration. HMAC tokenization keys sit in your environment today. Or they derive from your machine key. Not in a KMS. | Elastic Cloud Hosted, Elastic Cloud Serverless. And fully self-managed on-prem. That's 60 regions, across four clouds. Hard to beat. We don't claim to. | ◈ |
| Pricing | Published model, and a scoped instant quote. No sales wall. We enforce entitlements in code. By tier, we gate tool access at dispatch. We meter usage per agent, per call. | Unusually open for an enterprise vendor. Serverless lists ingest from $0.14 per VCU-hour. Search from $0.09. Storage from $0.047 per GB per month. Agent Builder runs $0.025 per execution. After 1,000 free. Agent tool calls become a metered line item. Worth modelling, before you build a chatty agent. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 not yet certified. We say so on the page. Not in a footnote. | Public company since 2018. An OpenAI partnership in July 2026. The Deductive AI acquisition in August 2026. A client list that includes PepsiCo. IBM and Comcast too. | ◇ |
◆ DataShield leads◇ Elastic leads◈ comparable
We draw Elastic claims from one place. elastic.co product docs. Also the Serverless pricing page. And the subscriptions page. Also Elastic's investor-relations press releases. Last checked 13 September 2026. We link them below. Rather than work from memory.
Three things you get here that you won't get from a search platform
The PII is gone before the prompt exists
A retrieval filter decides one thing. Which docs a role may read. It runs after the values sit in the index. Already. In the clear. We tokenize at ingest instead. Each value crossing into a prompt passes a gate. A fail-closed one. We redact a PII column. One with no configured treatment. A PHI data set refuses an AI endpoint. Unless it's marked BAA or ZDR approved. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute retrieval job. We re-check the next checked tool call. Against current access. It fails closed. An API key configured last quarter keeps working. At least until someone remembers to delete it. How Auth does it.
Proof, not a log file
Whoever owns the cluster can edit any log. Ours is a hash chain. With signed, chained checkpoints. The verifier tells you what broke. Not just that something did. That's the property reviewers care about. Think EU AI Act Article 12, HIPAA §164.312(b). Try it in your browser, no signup.
Where Elastic is genuinely stronger
Retrieval is their craft. It shows. One engine covers keyword and dense vector search. Sparse vector and hybrid ranking too. Better Binary Quantization landed on by default in 9.1. It claims a 5x speed-up over OpenSearch. Plus a large memory saving. ES|QL now has joins and cross-cluster search. Their 2026 writing on context engineering: the best public thinking. We've read a lot. It explains one thing. Why retrieval still beats a bigger context window. We say that as a competitor. Add 300+ integrations. 60 regions. A GA MCP server. Also open pricing, and an OpenAI partnership. That's distribution we will not match. If your question is "which engine finds the right chunk": ask them. Not us.
Here is the push-back. Their July 2026 language is "permission-aware retrieval". The mechanism underneath it is Elasticsearch roles. With query templates. That's access control, not data protection. The sensitive values still sit in the index. In the clear. They document that gap. Not us. Their DLS page says a restricted user can still learn something. Aggregate data. Also field names and term counts. From docs they can't read. Field- and document-level security also lives somewhere else. In Platinum and Enterprise. New self-managed clients can't buy Platinum. So ask an Elastic seller three things. Which tier is the safety story in? Does a raw value ever reach a prompt? Before the filter runs? Who can show you afterwards? That it did not?
Questions worth asking both of us
These are the questions we'd want answered. If we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained. Verification returns one of three outcomes. Clean, attested damage, or tampered. Re-tamper a chain already marked as damaged. It flips back to tampered on its own. Run it against a sample chain at /verify. Elastic: Elasticsearch writes audit logs. Kibana shows activity. We found no tamper-evidence claim. Not in their docs. Ask them to show one.
What happens to a revoked agent mid-session?
We re-check access on each checked tool call. Revocation lands on the very next call. The context drops to anonymous. Elastic's Agent Builder controls access. With security roles and API keys. Set up in advance. We couldn't find a mid-session re-check. Not in their public docs. Ask how long a compromised agent keeps retrieving. After you pull its key.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject key. Each ciphertext for that subject goes unreadable. All at once. We also issue an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. The proof still checks out. Even after the subject leaves. Elastic gives you delete by query. And index lifecycle management. Ask what happens to embeddings. Ones already computed from the deleted text. A vector built from a person's notes still traces back. To them. To that person.
Do we have to rip out Elasticsearch to use DataShield?
No, and most people shouldn't. Keep the index. Our retrieval covers the data sets we check. Not your whole estate. Hybrid keyword and vector search over pgvector. Ingest from files, URLs and S3-compatible storage. Plus PDF, DOCX and EML extraction. If the sensitive subset is what agents touch, check that subset. Right here. Let Elastic serve the rest. The real question is where the enforcement and the proof land. Not which engine ranks better.
Elastic ships an MCP server too. What's different?
Theirs exposes Agent Builder tools and Elasticsearch data. To external clients. It's a good piece of work. Ours is where you query the checked data. Itself. The tool token carries a scope ceiling. We authorize and meter the call before dispatch. We then seal the call into the chain. One more difference worth pricing. Their Agent Builder runs bill at $0.025 each. After the first 1,000. Agent loops aren't famous for calling a tool once.
Is our RAG content masked, really?
Partly. We'd rather be precise than flattering. We tokenize or generalize structured data set columns. The prompt-egress gate fails closed on unconfigured PII. RAG chunk views mask at read time. They rebuild the keyword index. From masked text. Search can't be used as a probe. But we index free-text docs you upload. As written. Apart from a standing sensitive-pattern filter. Our own tool docs say so. Don't put a document in the corpus. Not one that needs its body text masked.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Auth is live. It ships with a public threat model. Also a verifier anyone can run. Guardian and Lighthouse have been in production. Since April 2026. Design-partner terms include source escrow. That way, a small vendor stays safe. Never a single point of failure. Details on the security page.
- Elastic positions itself as the context layer for frontier models: agents get "relevant, real-time context with the right permissions," via "Elastic AI Assistants, Agent Builder and MCP integrations." - Elastic investor relations, 30 Jul 2026
- Agent Builder is "an AI conversational platform" over Elasticsearch data, exposes tools through an MCP server to clients like Claude Desktop and Cursor, and controls access with "security roles and API keys." - Elastic product docs, 13 Sep 2026
- Document-level security documented limitation: restricted users "can still craft searches revealing aggregate data, field names, and term counts from inaccessible documents." - Elasticsearch reference docs, 13 Sep 2026
- Field- and document-level security is a Platinum and Enterprise feature; self-managed Platinum is closed to new customers. - elastic.co/subscriptions, 13 Sep 2026
- Serverless pricing: ingest from $0.14 per VCU-hour, search from $0.09, storage from $0.047 per GB per month; Agent Builder 1,000 executions free, then $0.025 per execution. - elastic.co/pricing/serverless-search, 13 Sep 2026
- Better Binary Quantization on by default in Elastic 9.1, claimed "5x faster than OpenSearch," alongside ES|QL joins and cross-cluster search GA. - Elastic blog, 29 Jul 2025
- Elastic's search-labs team argues context engineering has "succeeded prompt engineering as the core discipline for agent quality." - Elastic blog, 18 Aug 2026
Other head-to-heads
DataShield vs Glean
Permission-mirroring search, versus access checked at the call.
RAGDataShield vs Azure AI Search
A cloud retrieval service. And the evidence layer it doesn't ship.
RAGDataShield vs Vespa
Ranking engineering at scale, versus checked data for agents.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask what your retrieval layer still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →