Head-to-head · updated 13 September 2026

DataShield vs Estuary: the rows land in a second, but who governs them after that?

Estuary Flow is a real-time data movement platform, and a good one. Log-based CDC, streaming and batch in the same system. They claim sub-100ms latency and 200-plus connectors. Three petabytes moved a month. 5,500 users. Their own hero says it plainly: "Streaming, log-based CDC, and batch in one platform." One you can do arithmetic with. We like that.

An ELT tool this is not. We have no CDC. No replication slots. No connector catalogue to match theirs. We pick the problem up where the pipeline drops it off. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data. A privileged step. It's audited each time. We classify fields against 129 PII, PHI, financial and secret classes. We check each checked tool call. Against the agent's current access. That happens before it runs. We then seal the decision into a hash chain. You can verify it yourself. Here is the honest split. It includes the rows they win.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Agents are already reading the data your pipeline delivers. Nobody can say which columns each one may touch.
You need to pull an agent's access mid-job. The very next tool call should fail. Not the next token refresh. The next call.
Someone will ask you to prove an access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Run the verifier and see what the answer looks like.
The data plane, the policy decisions and the proof. All have to run on your own hardware. On keys you hold.

Pick Estuary when

You need rows out of a Postgres write-ahead log, and into Snowflake, in under a second. That's their whole craft. We do none of it.
Connector breadth decides the deal. 200-plus managed connectors is years of work we haven't done.
Your procurement team wants a SOC 2 Type II report on the desk this quarter. They have one. We don't.
You are paying Fivetran by monthly active rows, and the bill keeps surprising you. Their $0.50 per GB rate card is a real answer to that.

Bottom line: Estuary moves the data. We check it once it has landed. Almost nobody has to choose. Most teams who buy us already run a pipeline tool of some kind.

Feature by feature

Competitor cells describe what Estuary's public site and blog say. We use the date above. If we got a fact wrong, email support@myorg.ai. We'll correct it, and credit you.

What matters	DataShield	Estuary	Edge
Real-time data movement	None. We ingest files. We watch S3, Azure Blob, GCS, SFTP and SMB subtrees. For new objects. We register a live PostgreSQL source. As a catalog provider. There's no change data capture, and no streaming runtime here.	The product. Log-based CDC, streaming and batch. In one pipeline model. A claimed sub-100ms latency. And a runtime they rebuilt in August 2026.	◇
Connector breadth	Narrow on purpose. PostgreSQL is the one catalog provider with working handlers. Scan, profile and extract. Snowflake, BigQuery, Databricks, S3, Kafka and Salesforce sit on the roadmap. No handler yet. We say so in the config file.	More than 200 managed connectors. Across databases, warehouses, apps and cloud services.	◇
Field classification	129 built-in classes, covering PII, PHI, financial data and secrets. That includes all 18 HIPAA Safe Harbor identifiers. Regex plus checksum validation. Luhn, NPI, Verhoeff, ABA, IBAN, GTIN. Plus column-name lexicons and anti-pattern suppressors. No model. So verdicts are reproducible from a config digest.	Not part of the product. Their compliance guide says sensitive fields "can be excluded or transformed before reaching downstream systems." Not a classifier that finds them.	◆
Tokenization and data handling	Deterministic, join-preserving, vault-reversible tokens. Applied at ingest. Plus quasi-identifier generalization. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking. Each column gets a measured score. A cardinality-reduction score. Detokenization stays privileged. We audit every lookup.	Encryption in transit and at rest. With customer-managed KMS keys. And SOPS-encrypted connector credentials. Tokenization isn't vocabulary they use.	◆
Audit evidence	A SHA-256 hash chain over the record stream. With Ed25519-signed checkpoints. Those checkpoints are themselves chained. Verification returns one of three verdicts. Clean, attested damage, or tampered. It names the exact break. Try the verifier.	Audit logs cover config updates. Plus replays and backfills. Plus a History Mode. It keeps each event. That's pipeline change history. We found no cryptographic tamper evidence.	◆
Agent authorization	Each checked tool call passes a scope ceiling. Also a consented-tool allowlist. Plus an access tier, and a fresh revocation check. That's before dispatch. It fails closed.	Role-based access control. With namespace prefixes and read, write and admin features. Plus SSO at the Enterprise tier. That governs who edits pipelines. Not what an agent reads from a row.	◆
Break-glass	Scoped, time-boxed emergency access. Admin and IP-allowlist gated, with step-up. It auto-revokes on its own. It can't be quietly removed from the log.	Not in their public material at all.	◆
GDPR erasure	Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor identities in the chain carry HMAC commitments. The audit still checks out. Even after the subject is gone.	They state adherence to GDPR, CCPA and CPRA. Plus BYOC for regional processing rules. The erasure method itself isn't in their docs.	◆
MCP and agents	More than 200 MCP tools. Across Ontology, Auth, Corpus and Lighthouse. Agents query the checked data itself. Under tool tokens, with scope ceilings. We meter each call. And attribute it to the agent.	Agent Skills: markdown instruction packs. They teach Claude Code, Codex or Gemini CLI. How to build a pipeline. Clever, and genuinely useful. It's an authoring surface for engineers. Not a runtime the agent reads data through.	◆
Deployment	Self-hosted. In your own cloud or data center. Or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse. Guardian verifies a signed deploy manifest. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Keys rotate by kid. It fails closed on an unknown key. KMS custody is a built seam in Auth. So is HSM. Not a shipped integration. HMAC tokenization keys sit in your environment. Or they derive from your machine key. Not in a KMS.	Three first-class modes. Public SaaS, in EU and US regions. A network-isolated private deployment. Bring-your-own-cloud. PrivateLink and Google Service Connect. At the Enterprise tier. This is one of the better hosting stories. In their category.	◈
Compliance certifications	Design citations only. HIPAA §164.312(b) and §164.514(b). GDPR Art. 17 and Art. 25. Plus ISO 27560, RFC 8785. SOC 2 isn't certified. We won't imply it is.	SOC 2 Type II. With stated adherence to HIPAA, GDPR, CCPA and CPRA. BYOC, plus a BAA as the HIPAA route.	◇
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. Small team. Source escrow in design-partner terms. SOC 2 not yet certified.	Founded 2019. 5,500 users. Three petabytes moved a month. A 99.9% uptime SLA. Named clients include Glossier, Xometry and Together AI.	◇
Pricing	Published model, and a scoped instant quote. No sales wall.	Published too. A free 10 GB tier. Then $0.50 per GB and $100 per connector for the first six, $50 after that. Enterprise is quote-only.	◈

◆ DataShield leads◇ Estuary leads◈ comparable

We draw Estuary claims from estuary.dev. Plus its pricing page and its blog. Last checked 13 September 2026. We link them below, rather than work from memory.

Three things you get here that you won't get from a data movement platform

The pipeline knows the schema. It doesn't know the risk.

A CDC stream will happily carry medical record numbers. Right into your warehouse. It has no opinion about that. We label fields against 129 classes. That includes each HIPAA Safe Harbor identifier. We use regex, checksums and column-name evidence. No model. So the same column gets the same verdict next month. How the catalog works.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. We re-check the next checked tool call. Against current access. It fails closed. Pipeline RBAC won't help you here. It governs the pipeline. Not the read. How Auth does it.

An erasure you can defend

GDPR says delete. Your auditor says keep the log. Crypto-shred settles it. We destroy the subject's key material. The data goes unreadable. The chain still checks out. See the diagram.

Where Estuary is genuinely stronger

They're better at their job. Than we would be. Log-based CDC is hard. The parts that hurt are the parts nobody demos. Replication slot bloat. Multi-day backfills. Running while production keeps writing. Schema drift. Landing in a warehouse at 3am. Estuary writes about all three in public. That's usually the sign of a team. One that's been paged for them. The May 2026 pricing post picks apart something. Fivetran's monthly-active-rows meter. That's the kind of thing a vendor only publishes. Only when the arithmetic is on its side. And their hosting ladder is real. Public SaaS. A network-isolated private deployment. And bring-your-own-cloud. A SOC 2 Type II report sits behind it. We have self-hosting and honesty. That's not the same as a report.

Here is the push-back. Their compliance guide describes audit logs. Over config updates, replays and backfills. That's a record of what the pipeline did. It's not a record of what a person did. Or what an agent did with a row. Not after the pipeline delivered it. Those are the entries an examiner asks for. The same gap shows up in their access control. RBAC with namespace prefixes decides who can edit a capture. It doesn't decide one thing. Whether the support agent may read it. The unmasked phone number. Freshness is a real problem. And they solved it. Governance of the landed data is a different problem. It's ours.

Questions worth asking both of us

These are the questions we'd want answered. If we were the ones buying. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. We sign and chain the checkpoints. The verifier tells deletion apart. From truncation, and from tampering. Try it against a sample chain at /verify. Estuary: their public material describes audit logs. Over config updates, replays and backfills. Also a History Mode. It retains each event. We found no tamper-evidence method. Ask them what stops a privileged user. Editing that history.

What happens to a revoked agent mid-session?

We re-check access on each checked tool call. A revocation lands on the next call. Not the next token refresh. Estuary has RBAC and SSO at the Enterprise tier. That covers pipeline operators. We couldn't find anything about that. Revoking an agent's read access in flight. That's not really what their access model is for. Ask both of us one thing. How long a compromised credential keeps working.

How does GDPR erasure interact with the audit trail?

We crypto-shred per-subject key material. We issue an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. The proof still checks out. Even once the subject is gone. Estuary states GDPR, CCPA and CPRA adherence. It offers BYOC for regional processing rules. The method for an actual erasure request isn't spelled out. Not across a replicated stream. Ask for the mechanism. Not the certification.

Is DataShield a CDC or ELT tool? Do we drop Estuary?

No, and no. We have no change data capture. No replication slots. No streaming runtime. If you need rows out of a database log, in under a second: buy Estuary. Or a tool like it. Run us on the data agents actually query instead. That's where the obligation sits. Classification, tokenization, authorization and proof. The two sit end to end quite happily.

Estuary ships Agent Skills. Isn't that the same idea as your MCP surface?

Different layer. It took us a minute to see it. Their Agent Skills launched in July 2026. Markdown instruction packs. They let Claude Code or Gemini CLI stand up a pipeline. For you. The agent is the engineer's assistant. Our MCP surface is different. It's where an agent reads the checked data itself. Each call carries a tool token. With a scope ceiling. We authorize it before dispatch. It lands in the audit chain. One helps you build the pipe. The other decides what may come out of it.

Does DataShield have SOC 2?

Not yet, and we won't imply otherwise. Estuary does. If that gates your buy, this is a short conversation. What we offer instead: a public threat model. And a verifier anyone can run. Also source escrow, in design-partner terms. That way, a small vendor stays safe. Never a single point of failure. Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse, since April 2026. More on the security page.

Estuary's hero: "Streaming, log-based CDC, and batch in one platform." Claims sub-100ms latency, 200+ connectors, 5,500+ users, 3PB moved monthly and a 99.9% uptime SLA. - estuary.dev, 13 Sep 2026
Published rates: free Developer tier at 10 GB/month and 2 connector instances; Cloud at $0.50 per GB plus $100 per connector for the first six and $50 thereafter. - estuary.dev pricing, 13 Sep 2026
Estuary "maintains SOC 2 Type II certification and adheres to HIPAA, GDPR, CCPA, and CPRA"; audit logs cover configuration updates, replays and backfills, and BYOC with a BAA is the stated HIPAA path. - Estuary blog, 26 May 2026
Agent Skills are defined as "a set of instructions and (references to) resources for an AI agent (e.g. Claude Code, Codex, Claude Cowork, Gemini CLI) to perform a task." - Estuary blog, 6 Jul 2026
Pricing attack on Fivetran's monthly-active-rows meter: 800 GB across 2 connectors costs about $1,000/month on Estuary against a claimed $15,000 to $20,000 under MAR billing. - Estuary blog, 20 May 2026
Runtime rebuilt in 2026 for "faster, more scalable data movement with transactional correctness, autonomous scaling, and simpler operations." - Estuary blog, 26 Aug 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →