Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Google Dataplex: context for your agents, or control over them?

In April 2026 Google renamed Dataplex Universal Catalog to Knowledge Catalog. The new name is honest about the plan. The product page calls it "always-on context and governance for your agents". Does your data sit in BigQuery? It harvests the metadata. No connectors to run. It draws column-level lineage. You'd struggle to rebuild that by hand. It writes notes with Gemini. It serves the lot to Claude or Gemini CLI. From a remote MCP endpoint. Nothing to install. Nothing to procure.

We sell the next question. Which agent asked? Was it still allowed at that second? Can you prove the record later? We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a gated, audited step. Auth re-checks each tool call. It checks against the agent's current access. We seal each decision into a hash chain. You can verify it without trusting us. On GCP, most buyers run both. Here is the honest split. It has the rows Google wins.

Get free Demo Center access Get an instant quote
DataShield vs Google Dataplex at a glanceEight questions regulated buyers ask us. Scored from each vendor's public documentation. DataShield vs Google Dataplex at a glance Eight questions regulated buyers ask us. Scored from each vendor's public documentation. DataShield Google Dataplex Tamper-evident audit chain you can verify Authority re-checked on every tool call Break-glass access for agents GDPR erasure that keeps the chain valid Runs outside Google Cloud Field-level PII and PHI classification in the catalog Column-level lineage across the analytics estate Metadata coverage of a large cloud estate shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • Someone will one day ask you to prove an agent's access record wasn't edited. Cloud Audit Logs are retained and exportable. Ours are chained and signed, and the verifier names the failure. Run it yourself.
  • The catalog has to run where Google does not. Self-hosted in your own cloud or data center. Or a dedicated single-tenant server we operate, with your keys. See the architecture.
  • You need to pull an agent's access mid-session. The very next tool call should fail closed. Not wait out a token. How Auth does it.
  • You want PII and PHI labels as first-class catalog objects, not a separate scanning product. We classify columns against 129 field classes. The catalog stores no column values by default. What Ontology holds.

Pick Google Dataplex when

  • Your estate is BigQuery. Metadata from tables, views, models, Spanner, Bigtable, Cloud SQL, Looker and Pub/Sub arrives on its own. We cover PostgreSQL today, not your whole estate.
  • You want column-level lineage for BigQuery and Vertex AI pipelines. Google reads its own query logs. No third party gets that depth from outside.
  • Gemini in the catalog is worth money to you: generated descriptions, semantic search, inferred relationships, and profile scans over unstructured data.
  • Procurement is the bottleneck. It's already on the GCP bill. The first 100 DCU-hours each month are free. There's no new vendor to onboard.

Bottom line: Google gives your agents context. We decide which agent may act on it. We keep proof that the decision was made. On GCP, run both. Off GCP, or in front of an auditor, start here.

Feature by feature: a platform catalog against a governed data plane

Competitor cells describe what Google's public docs, changelog and pricing page say. We use the date above. Did we get this wrong? Email support@myorg.ai. We'll fix it and credit you.

What mattersDataShieldGoogle DataplexEdge
Audit evidenceSHA-256 hash chain with Ed25519-signed checkpoints, themselves chained. It returns clean, attested damage, or tampered. It names the break. Try the verifier.Cloud Audit Logs: Admin Activity plus Data Access logs you switch on. The logging doc shows no integrity proof. No signatures, either. Nothing locks the log itself.◆
Agent authorizationEach checked tool call in Auth passes a scope ceiling. Plus a consented-tool allowlist. A named access tier comes too. Plus a revocation re-check before dispatch. Delegation is RFC 8693 token exchange with an enforced ceiling.The MCP server uses OAuth 2.0. With IAM roles, such as roles/mcp.toolUser. That tells the catalog which human or service account stands behind the call. It doesn't give the agent its own access, though. It doesn't re-check it, either.◆
Break-glassScoped, time-boxed emergency access for agents. It auto-revokes. It cannot be quietly wiped from the record.Not offered. You'd have to build it from IAM conditions. And hope the rollback stays clean.◆
GDPR erasureCrypto-shred of per-subject key material. Plus ISO 27560 consent receipts. HMAC commitments stand in for actor identities. So the chain still verifies after you erase a subject.Not a stated function of the catalog. It records where the data is. Deleting it is yours. So is proving you did.◆
Tokenization and data handlingWe tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization needs a gated step. We audit it, always. Tokens stay deterministic. They're join-preserving, too. Quasi-identifier generalization is there too. Just switch it on. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking. Each gets a measured cardinality-reduction score.The catalog is metadata. De-identification is its own Google product. Sensitive Data Protection, billed and set up on its own. Column-level security runs on BigQuery policy tags.◆
Sensitive-data classification in the catalog129 field classes cover PII, PHI, financial data and secrets. That has all 18 HIPAA Safe Harbor identifiers. Regex plus checksum checks. Luhn, NPI, Verhoeff, ABA, IBAN, GTIN. Plus column-name word lists and anti-pattern filters. No model, so verdicts stay consistent from a config digest. By default, the catalog copies no column values.Data profiling and quality scans, in the Premium tier. With Gemini's semantics, too. Sensitive-data tagging leans on Sensitive Data Protection. Plus BigQuery policy tags. Not the catalog itself.◆
Catalog coverage and lineageWe scan, profile and classify a live PostgreSQL source in place. No rows leave it, ever. Typed lineage path, with per-hop access gating. A glossary comes from entity types. Plus stewardship worklists. The flows that own the lineage derive it. Not a stored column-level graph. PostgreSQL today, not your whole estate.Auto-grabbed metadata. Across BigQuery, Vertex AI, Spanner, Bigtable, Cloud SQL, Looker and Pub/Sub. Plus table- and column-level BigQuery lineage. Plus business glossary, aspects, data products, and Iceberg REST cataloging. This is their round. It isn't close.◇
Context for agentsAgents query the catalog and act on it through MCP. Ontology's catalog, stewardship and lineage parts are MCP-native. Auth issues MCP tool tokens with scope ceilings for its own surface.A truly good story. Remote MCP server at dataplex.googleapis.com/mcp. Plus a data-products endpoint. Lineage MCP is in Preview too. Plus a lookupContext bundle built for agent workflows. Gemini CLI, ChatGPT and Claude are all listed clients.◇
MCP and agents overallMore than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Per-call metering ties to the agent. It gives typed refusals when a quota bites.MCP for discovery and data products, with lineage in Preview. No agent identity of its own. No per-call access re-check. There's no metering tied to an agent, either.◆
DeploymentSelf-hosted, in your own cloud or data center, your call. Or on a dedicated single-tenant server we run. Docker builds ship for Auth, Ontology, Corpus and Lighthouse. Guardian checks a signed deploy file.A hosted Google Cloud service. No self-hosted option, no on-prem option. Third-party and on-prem sources arrive through connectors, not as first-class members.◆
Maturity signalsAuth, Guardian and Lighthouse are live in production. Guardian and Lighthouse since April 2026. No SOC 2 yet. We say so, plainly.Alphabet. GCP compliance reach. A release note most weeks. Google's own claim: over 95% of its top analytics clients use Dataplex. Three product renames in four years is the one wobble.◇
PricingPublished model, scoped instant quote, no sales wall.Published rates, metered in Data Compute Unit hours. $0.06 per DCU-hour Standard. 100 free each month. $0.089 Premium for lineage, quality and profiling. No free allowance there. About $2 per GiB-month for custom metadata. Cheap to start. Hard to forecast.◈

◆ DataShield leads◇ Google Dataplex leads◈ comparable

Google claims come from cloud.google.com. From its product, docs, changelog and pricing pages. We checked them on 13 September 2026. We link them below, not just a paraphrase from memory.

Three things you get here that you won't get from a platform catalog

Proof the record wasn't edited

A retained log is not a tamper-evident log. Ours is a hash chain with signed checkpoints. The verifier tells you what went wrong. Tampering, insertion, deletion, or truncation. EU AI Act Article 12 reviewers keep asking about that. So does HIPAA §164.312(b). Try it in your browser, no signup.

Authority that changes mid-flight

An analyst resigns on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, we re-check the next checked tool call. We check it against current access. It fails closed. An IAM change is eventually consistent. The call in flight rarely notices. How Auth does it.

A catalog that can leave the cloud it governs

Knowledge Catalog is a Google Cloud service. It's staying put. Does your estate span clouds? Does your regulator want the control layer outside the provider's blast radius? Then the catalog has to be yours. Ours runs in your data center. Or on a single-tenant server we run. See the architecture.

Where Google Dataplex is genuinely stronger

Let's be blunt about the rows we lose. Is your data in BigQuery? Google reads its own query logs. It hands you table- and column-level lineage. No one else can rebuild that. Grabbing metadata needs no connectors. Gemini writes the notes. It finds links. It suggests SQL patterns. Since June 2026, it runs profile scans. They cover unstructured data. Data products went GA in May 2026. So an agent gets a shaped unit, not a raw one. The MCP endpoint is live today. Any Claude or ChatGPT client can hit it. The first 100 DCU-hours each month are free. Against that, our catalog is GA for PostgreSQL only. Declared for the rest. We won't pretend otherwise.

Here is the push-back, though. All of that is context. Context is not control. An agent calls their MCP server. It acts under IAM, as a service account or a user. The catalog has no idea the agent's access changed 90 seconds ago. The record of that call lands in Cloud Audit Logs. You can retain those. You can export them, too. But they carry no integrity proof of their own. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations. Not attacks. A better write-up of your tables won't help you there. A signed chain will. One that shows who asked. What they could do. When the access went away.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on each vendor call, including ours.

Can you cryptographically prove an audit record wasn't deleted?

DataShield: yes, it can. Each record commits to the one before it. We sign and chain the checkpoints. It separates deletion from truncation from tampering. Try it on a sample chain at /verify. Google: catalog activity lands in Cloud Audit Logs. You switch on Data Access logs yourself. We found no posted tamper-evidence, though. Not for the log itself. Ask them how you'd spot a missing entry six months later.

What happens to a revoked agent mid-session?

DataShield re-checks access on each tool call. So a revocation bites on the next call. The context drops to anonymous, right then. With Dataplex, you're trusting IAM instead. Ask how long a running agent keeps catalog access. After you remove the role, that is. And whether the call in flight fails or completes.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material. Then it issues an ISO 27560 consent receipt. HMAC commitments stand in for actor identities in the chain. So the evidence still checks out after the subject is gone. Knowledge Catalog has no erasure function. It's metadata about where things live. Someone still has to own the deletion. And the proof.

Is this a Dataplex alternative, or something you run next to it?

Next to it, if you live in BigQuery. Their metadata grab and column-level lineage beat ours. It costs you almost nothing to start. We become the choice when the estate spans clouds. Or when the setup must be self-hosted. Or when the job is proving an agent's actions. Not just tables. Keep their context. Put the checked data plane and the evidence here.

When an agent calls your MCP server, what identity is it acting under?

Ask Google this one. Their remote MCP server uses OAuth 2.0. With IAM scopes and roles, such as roles/mcp.toolUser. That means the agent borrows an identity. A human one, or a service account. In DataShield Auth, the agent holds its own MCP tool token. With a scope ceiling attached. Its access gets re-checked per call. Each call ties back to that agent, metered.

Google is discontinuing the old Data Catalog. Does that change anything?

It changes the timing. Legacy Data Catalog went end of life on 1 June 2026. Google renamed Dataplex Universal Catalog to Knowledge Catalog. That was in April 2026. Plenty of teams are starting the migration ticket anyway. That's a good moment to ask a bigger question. Which parts of control sit inside a cloud provider? Which parts do you want to own?

Does DataShield have SOC 2?

Not yet. We won't imply otherwise. Google Cloud's compliance reach is huge. That's a fair thing to weigh against a small vendor. What we offer instead is open. A posted threat model. A verifier you can run. Auth, Guardian and Lighthouse live in production since April 2026. Design-partner terms include source escrow. Details on the security page.

Other head-to-heads

Platform catalog

DataShield vs Unity Catalog

The other platform catalog, and the same question about control.

 Platform catalog

DataShield vs Microsoft Purview

Governance bundled with the cloud you already bought.

 Cloud-native

DataShield vs Google Cloud DLP

Google's other half of this story: finding the sensitive data.

 All

Every comparison

One honest scorecard per vendor, including the rows we lose.

Keep Google's context. Add the part it doesn't do. Break a live audit chain in your browser. Revoke an agent mid-session. Then decide. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →