Head-to-head · updated 13 September 2026

DataShield vs Elementary: the dbt tests are green, so who let the agent read the table?

Elementary is the dbt-native data monitoring tool that people actually keep. It started as an Apache-2.0 dbt package. It still is one. Any dbt shop can add volume, freshness and schema tests. In an afternoon. No new servers. The Cloud adds automated monitors on each production table. Also column level lineage into the BI view. Plus incident grouping and health scores. It also ships a real MCP server your agents can call. Their September 2026 post asks a good question. Can an agent trust this data, for this query, right now?

We answer the other half of that sentence. DataShield doesn't watch your pipelines. We have no checks, no freshness SLAs and no pager. Instead, we check the data agents read. We tokenize it at ingest. Agents query tokenized data over MCP. Turning a token back into real data is a gated step. It's audited each time. We check each checked tool call against the agent's current access. That happens before it runs. We then seal the call into a hash chain. Anyone can verify it. Below is the honest split. It includes the rows Elementary wins.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove an agent's access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
You need to pull an agent's access mid-session. The very next tool call should fail. Not the next token refresh.
The question on the table is what is in the data, not whether it arrived on time. We classify fields against 129 PII, PHI, financial and secret classes. Then we tokenize and mask what matters. See the catalog.
Everything has to run on your own hardware. Agents and MCP server included, on keys you hold.

Pick Elementary when

You run dbt and want value this week. The package drops into your project. Config lives in YAML, next to your models. The tests run where your models run.
The pain is silent pipeline failure. A table stopped refreshing on Saturday. Nobody noticed until Tuesday. That's their home ground, and they're good at it.
You want column-level lineage from source to dashboard, plus incident grouping that cuts alert noise. We ship typed lineage edges, not a BI-to-source graph.
You need SOC 2 Type II on the vendor today. They have it. We don't, and we say so.

Bottom line: Elementary tells you whether the table is healthy. We decide whether the agent may read it. We also keep proof of what happened. Most dbt shops that talk to us already run Elementary. We wouldn't ask them to stop.

Feature by feature

Competitor cells describe what Elementary's public site, docs and blog say. We use the date above. If we mischaracterised something, email support@myorg.ai. We'll correct it, and credit you.

What matters	DataShield	Elementary	Edge
Pipeline monitoring and anomaly detection	None. We have no checks on warehouse tables. No freshness SLAs, no alerts, no odd-data catch. We won't say we do.	The core product. Volume, freshness, schema and column-metric anomaly tests, in the OSS package. Plus no-setup auto checks, across each live table in Cloud. Training periods run up to three months.	◇
Dataset profiling and trust scoring	Each dataset gets a 20-section profile. Field stats, patterns, column meaning. A link graph, quality checks, change lineage. Work rules, source fingerprint. A weighted trust score rolls up. Per entity type, domain and estate. It carries a per-axis view and trend, recomputed each hour.	Data Health Scores, built from test and check outcomes. Plus coverage reports. Scored on whether checks pass. Not on what the data looks like.	◆
Sensitive data classification	129 field classes, covering PII, PHI, money data and secrets. Deterministic and reproducible. 18 HIPAA Safe Harbor classes carry a regulation cite. We scan and profile a live PostgreSQL source in place. No rows leave it. That's PostgreSQL today, not your whole estate.	Out of scope by design. Their docs say plainly that Cloud "does not have read access to raw data in your data warehouse." Quoted in full. It stores only metadata, logs and rolled-up metrics. Good for a security review. No use for the PHI question.	◆
Audit evidence	A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are themselves chained. A check returns clean, old damage, or new tamper. It names the exact failure: tamper, insert, delete or cut-short. Try the checker.	SOC 2 Type II and HIPAA claims, for their own service. Audit reports are available on request to legal@elementary-data.com. That's assurance about Elementary. It's not an proof artefact about your agents.	◆
Agent authorization	Each checked tool call passes a consented-tool allowlist. Also a scope ceiling. A declared access tier, too. And a mid-session pull-back re-check. That's before dispatch. It fails closed.	The MCP server is called "a single authenticated endpoint" for models, tests, incidents, lineage and execution history. Plus test authoring. We found no per-call authorization model in their public docs.	◆
Break-glass	Scoped, time-boxed emergency access, just for agents. It auto-revokes on its own. It can't be quietly removed from the log.	Not in their public material at all.	◆
GDPR erasure	Crypto-shred of per-subject keys, cited to ISO/IEC 27040 and GDPR Article 17. Plus ISO 27560 consent receipts. The audit chain still checks out afterwards.	A DPA, EU-default residency in Frankfurt, and metadata-only storage. So there's less to erase. No subject-level wipe method is in their docs.	◆
Tokenization and masking	Deterministic, join-preserving, vault-reversible tokens, applied at ingest. Plus quasi-ID generalization. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking. Each column gets a measured cardinality-reduction score. Features you switch on, not defaults.	Not part of the product. Failed-row samples are the only row data they touch. You can turn those off too, with test_sample_row_count: 0.	◆
MCP and agents	More than 200 MCP tools, across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings. It meters each call, and attributes it to the agent. Then it seals an audit row. Delegation is RFC 8693 token exchange, with an enforced scope ceiling.	A real remote MCP server since July 2025. Named agents for test recommendations, triage, governance, catalog and cost. Now merged into one orchestrating agent. It serves metadata and can author tests. Cloud only. They price the AI Layer separately, on credits.	◆
dbt-native workflow	We are not a dbt tool. Ontology ingests, catalogs, profiles, transforms and snapshots datasets on its own. That's a different shape of work.	Genuinely excellent. Config as code in dbt YAML. Artifacts persisted into your own warehouse schema. Lineage derived from dbt itself. Nothing extra to run.	◇
Deployment	Self-hosted, in your own cloud or data center. Or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse. Guardian verifies a signed deploy manifest. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Keys rotate by kid. It fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. Not a shipped integration. HMAC tokenization keys sit in your environment today, not in a KMS.	Cloud is SaaS on AWS. EU Frankfurt by default, with a US option. You self-host the free OSS edition. But it's a dbt package and a static HTML report. The agents, MCP server, catalog, incidents and health scores are all Cloud. "Advanced Deployment Options" appear at Enterprise, with no public docs.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 not yet certified, and we say so.	Repo created August 2021, 2,406 stars, Cloud GA April 2024. SOC 2 Type II, HIPAA claim, AWS Marketplace, a Gartner Typical Vendor listing. A logo wall too: Elastic, Klarna, IKEA, Zoom.	◇
Pricing	Open model, scoped instant quote, no sales wall. A free self-hostable path exists.	Apache-2.0 OSS is free forever. Cloud is three quote-only tiers. Priced on editor and viewer seats, plus monitored tables. A per-1K-table overage, and a credit-priced AI Layer add-on. No dollar figures open anywhere.	◈

◆ DataShield leads◇ Elementary leads◈ comparable

We draw Elementary claims from elementary-data.com and docs.elementary-data.com. Also their blog. Last checked 13 September 2026. We link them below, rather than work from memory.

Three things you get here that you won't get from a data observability tool

Proof that survives an audit

A log you can silently edit proves nothing. Ours is a hash chain, with signed checkpoints. The checker tells you what broke. Not just that something did. It tells old, signed-off damage apart from new tamper. That's the trait reviewers care about. Think EU AI Act Article 12, HIPAA §164.312(b). Try it in your browser, no signup.

Authority that can change mid-flight

An analyst hands in her notice on a Friday. Her agent is 20 minutes into a 40-minute job. We re-check the next checked tool call against current access. It fails closed. A monitoring tool will show you a healthy table the whole time. Because the table is healthy. How Auth does it.

A view of what is actually in the column

Metadata-only is a lovely security story. Right up to the moment someone asks whether an agent read PHI. We classify fields against 129 classes. The 18 HIPAA Safe Harbor ones get a regulation cite. We can generalize or tokenize them, before an agent sees a row. See the classification story.

Where Elementary is genuinely stronger

Let's be fair about this. Elementary solved a problem we don't touch. A model stops running? They catch it. A source stops feeding? They catch it. Same if a column fills up with nulls. They route the alert too. Their clients say the alerts are mostly real, not noise. The OSS package is good engineering. Config lives in dbt YAML. Results land in your own warehouse schema. Lineage comes from files you already make. Their Cloud adds column level lineage. It reaches the BI view. Also incident grouping, cost tips, and a live MCP server. That's more shipped agent surface than most of this market can show. They hold SOC 2 Type II. They claim HIPAA fit. In April 2026 someone broke into their CI pipeline. A bad Python CLI reached PyPI.

They opened a full incident report. People got a marker file to check. They told people to assume their keys leaked. That's the right way to handle it. Plenty of bigger vendors would have buried it.

Here is the push-back. It's structural, not a missing feature. Their setup never reads your rows. That makes the security review easy. It also leaves the sensitive-data question unanswered, for good. A Data Health Score says the table passed its tests. It can't say the table holds 40,000 patient records. It can't say an agent read it. Not after we pulled access an hour ago. Or that the log itself stayed clean. There's also a shape of risk worth naming. Fivetran and dbt Labs closed their merger on 1 June 2026. Three weeks before that, Fivetran took over Great Expectations. So the company that owns dbt now owns the best known open-source data quality project too. Elementary builds on both. That's not a reason to skip Elementary. It is a reason to keep your proof layer somewhere apart.

Questions worth asking both of us

These are the questions we'd want answered. If we were the ones buying. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained to each other. Verification tells delete apart from cut-short, and from tamper. Run it against a sample chain at /verify. Elementary: they hold SOC 2 Type II. They will send audit reports and pen-test results on request. That speaks to their own controls. We found no tamper-evident record of which agent or user read which asset. Ask them for one.

What happens to a revoked agent mid-session?

We re-check access on each checked tool call. Pull-back lands on the next call, not the next token refresh. Elementary's docs call their MCP server a single authenticated endpoint. It serves metadata and test authoring. Their public docs don't describe session pull-back or per-call scope. Ask how long a pulled credential keeps working.

How does GDPR erasure interact with the audit trail?

We crypto-shred the per-subject keys. That destroys each ciphertext for that subject at once. We also issue an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. The proof still checks out. Even once the subject is gone. Elementary stores metadata rather than rows. It defaults to EU residency in Frankfurt too. There's less subject data to erase. We found no written subject-level wipe path. Ask what happens to failed-row samples.

Is DataShield a data observability tool? Do we drop Elementary?

No, and no. We have no checks, no freshness SLAs. No odd-data catch, and no incident tools. If your problem is a pipeline that fails quietly, buy a monitoring tool. Buy a good one. Run us for the data agents read instead. That's where the job is classification, authorization and proof. Most dbt shops will sensibly run both. The two tools barely touch.

We already run the Elementary OSS package. Can we self-host everything?

Their OSS edition is a dbt package. Plus a CLI and a static HTML report. You self-host all of that. The parts most buyers want are Cloud-only SaaS on AWS. Agents, MCP server, catalog, incident management, health scores. "Advanced Deployment Options" show up on the Enterprise tier, with no public docs. Ask them exactly what that means, before you assume on-prem. DataShield ships Docker images for Auth, Ontology, Corpus and Lighthouse. The whole control plane runs inside your perimeter.

Both of you ship MCP servers. What's the difference?

Theirs hands an agent info: assets, lineage, incidents, tests, run history. It can author new tests too. That's a sound design for a monitoring product. Ours is where you query the checked data itself. The tool token carries a scope ceiling. We authorize and meter the call before dispatch. We then seal the call into the chain. Different jobs. Ask an agent what broke, using theirs. Let an agent read a patient table, using ours.

Does DataShield have SOC 2?

Not yet, and we won't imply otherwise. Elementary does hold SOC 2 Type II. That's a real gap on our side. What we offer instead is a public threat model. Also a checker anyone can run. Design partner terms include source escrow. That way a small vendor isn't a single point of failure. Auth, Guardian and Lighthouse are live in production, Guardian and Lighthouse since April 2026. Details on the security page.

Elementary's current positioning, verbatim: "Trusted Data for the AI Era. Observability, Quality, Governance, and Discovery under one control plane." Quoted in full. - elementary-data.com, 13 Sep 2026
Elementary Cloud "does not have read access to raw data in your data warehouse" and "only extracts and stores metadata, logs and aggregated metrics"; SOC 2 Type II and HIPAA compliant; EU (Frankfurt) default residency. - docs.elementary-data.com, 13 Sep 2026
The Elementary MCP server is exposed via "a single authenticated endpoint." Quoted in full. It serves asset info, table and column-level lineage, incidents, tests, models and run history. - docs.elementary-data.com, 13 Sep 2026
Elementary 2.0: "a data and AI control plane." Quoted in full. It has a shared context engine. Plus a network of AI agents covering observability, quality, governance and discovery. - Elementary blog, 1 Dec 2025
A malicious release hit them. Elementary OSS Python CLI v0.23.3, via a GitHub Actions script injection. Their own words: "Users who installed 0.23.3 ... should assume that any credentials accessible to the environment where it ran may have been exposed." Quoted in full. - Elementary blog, 27 Apr 2026
Fivetran and dbt Labs completed their all-stock merger, with dbt Core v2.0 alpha open-sourcing the Fusion engine under Apache 2.0. - Fivetran press release, 1 Jun 2026
Fivetran became steward of Great Expectations. The open source community, and the GX Core project. - Fivetran press release, 13 May 2026

Other head-to-heads

Observability

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →