Head-to-head · updated 13 September 2026

DataShield vs Keboola: your pipeline landed the data, so who governs the agent that reads it?

Keboola is a data operations platform with a sharp new haircut. It used to sell a self-serve data stack to data engineers. Today the homepage says "Your board wants AI. Your data isn't ready." It also pitches "the governed data foundation CFOs deploy before AI." Live in eight weeks, it says. Behind that pitch: 700+ connectors. Plus SQL and Python transforms, a scheduler, a Data Catalog. Plus finance logic most ELT tools never touch. A unified chart of accounts. Currency conversion. Intercompany eliminations. They shipped an open-source MCP server in 2025. That was before most of this market had a plan for agents. Good product. Real customers. A pitch with a point of view.

We build the layer underneath the answer. Not the pipeline that produced it. DataShield is not an ELT tool. It has no scheduler. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a privileged, audited step. We re-check each tool call against the agent's current access, before it runs. Each call seals into a hash chain. Anyone can check it, without trusting us. Below is the split. It includes the rows where Keboola wins outright.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove the agent access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
You need to cut an agent's access mid-session, and have the very next tool call fail. Not the next token refresh. The next call.
The data, the keys and the evidence have to sit on your own infrastructure. We ship Docker images and self-host. Keboola is a hosted platform.
The sensitive fields must be tokenized before an agent or a model ever sees them, and every detokenization has to leave a record.

Pick Keboola when

You need data moved. 700+ connectors. SQL and Python transforms. Jobs, flows, CDC. We do none of that and never will.
The buyer is the CFO. Chart-of-accounts harmonization, currency conversion and intercompany eliminations are real engineering, and almost nobody else packages them.
You want a platform that is already SOC 2 Type II with a decade of operating history. We are not certified yet.
You would rather rent the whole stack than run it. Their free tier starts at $0 and you can be building this afternoon.

Bottom line: Keboola gets the data into shape and gives the CFO a number they can trace. DataShield decides what an agent may do with that data and keeps proof of the decision. Most buyers who talk to us already have a pipeline tool. Very few have an answer for the audit question.

Feature by feature

Competitor cells describe what Keboola's public site, docs and blog say. We use the date above. Did we get something wrong? Email support@myorg.ai. We'll fix it and credit you.

What matters	DataShield	Keboola	Edge
Pipelines and connectors	None. We ingest files, URLs, and S3-compatible storage. We watch a bucket or SFTP path for new files. No connector list. No scheduler. Need data out of NetSuite? Buy a tool for that.	The core of the product. 700+ connectors. SQL and Python transforms. Jobs, flows, CDC, and streaming, at the Enterprise tier.	◇
Finance close logic	Nothing vertical. We classify, tokenize, resolve entities, and control access. Your chart of accounts is your business.	Unified chart of accounts. Currency conversion. Intercompany eliminations. Plus "Audit & Controlling Agents" that watch the numbers. A real vertical build.	◇
Audit evidence	SHA-256 hash chain, with Ed25519-signed checkpoints. We chain those too. Checking returns one of three verdicts. It names the failure: tampering, insertion, deletion, or truncation. Try the verifier.	Lineage back to the source journal entry. An activity centre. Audited support access. That's traceability, and it's useful. We found no cryptographic tamper evidence in their public material.	◆
Agent authorization	Each checked tool call passes a token scope ceiling. Plus a consented-tool allowlist. A declared access tier stacks on top. A live access re-check runs before dispatch. It fails closed.	Their MCP server uses OAuth sign-in. Plus project-level access control. Plus its own space per run. They scope access at the project boundary. They don't re-decide it per call. Ask them what happens on call number 400.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes. It needs step-up plus an IP allowlist. It can't be quietly deleted from the log.	Not described in their public material.	◆
GDPR erasure	Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. We commit actor identities in the chain as HMAC hashes. The log still checks out, even after the subject is gone.	A GDPR-aligned data processing agreement and regional deployment for residency. They do not describe the erasure method itself.	◆
Tokenization	Deterministic, join-preserving, vault-reversible tokens applied at ingest. Plus quasi-identifier generalization. Dates to year, decade or age band. ZIPs to 3 or 4 digits. Partial phones, SSNs and emails. Each column gets a measured cardinality-reduction score. Masking and generalization are switches you turn on. Not defaults.	AES-256 at rest, with AWS KMS. TLS in transit. Encryption, not tokenization. Tokens: not their word.	◆
Field classification	129 field classes covering PII, PHI, financial data and secrets. That includes all 18 HIPAA Safe Harbor identifiers. Regex plus checksums: Luhn, NPI, Verhoeff, ABA, IBAN. Plus column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. It cut over from shadow mode days ago. So it's new, not battle-worn.	Live metadata. A business glossary. A Data Catalog, at the Enterprise tier. Sensitive-field classification isn't a public feature.	◆
Catalog and glossary	A real catalog with asset and column metadata. A glossary materialized from entity types. Typed lineage traversal, with access gating at each hop. Plus a 29-command stewardship workflow. We scan and profile a live PostgreSQL source in place. No rows leave it. PostgreSQL today, not your whole estate.	Data Catalog, active metadata and lineage across everything the platform moves. That's a lot more sources than we touch. Gated to Enterprise.	◈
Entity resolution and MDM	Fellegi-Sunter probabilistic record linkage with Jaro-Winkler, Levenshtein, Soundex and Double Metaphone comparators. Plus LSH blocking and EM-trained parameters. Five survivorship strategies. Drift monitoring on each promoted match config.	Harmonization and mapping, mostly account and dimension alignment. We found no golden-record resolution engine in their docs. Worth asking, since the words look similar.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Tool tokens carry scope ceilings. We meter calls. We attribute them to the agent. Each one lands in the chain.	A real MCP server, open source under MIT. In use since May 2025. 30+ tools, for storage, SQL, jobs, flows, and data apps. It has OAuth login and a hosted endpoint. They were early. They deserve credit for it.	◆
Deployment	Self-hosted in your own cloud or data center. Or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. Ed25519 audit-signing keys stay on your instance, in a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth, not a shipped integration. HMAC tokenization keys sit in your environment today, not in a KMS. We say so.	Hosted on AWS, Azure or GCP. Single-tenant stacks. Dedicated domains. Regional residency at the Enterprise tier. No self-hosted option we could find.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse since April 2026. SOC 2 not yet certified, and we will not pretend otherwise.	Long history. A $32M Series A in December 2023, led by Viking Global, after a $5M seed. They claim 1,000+ companies. SOC 2 Type II is there under NDA.	◇
Pricing	Published model and a scoped instant quote, no sales wall.	Free tier at $0. Then 60 compute minutes a month. Then $0.14 a minute over that. Billed in Time Credits: one credit is an hour of job time. Enterprise is quote-only. It holds the Data Catalog, SSO, and the compliance package.	◈

◆ DataShield leads◇ Keboola leads◈ comparable

Keboola claims come from keboola.com, its pricing page, and its blog. Also the keboola/mcp-server repository. Last checked 13 September 2026. We link the sources below, rather than work from memory.

Three things you get here that you won't get from a data operations platform

Proof, not just lineage

Lineage tells you where a number came from. That assumes the record of it is honest. A hash chain tells you: was the record itself touched? Ours signs its checkpoints and chains them too. Delete a checkpoint, and it shows up. The verifier names what broke. Try it in your browser, no signup.

Authority that changes mid-flight

An analyst quits on a Friday. Their agent is 20 minutes into a 40-minute job over payroll data. With DataShield, we check the next tool call against current access. It fails closed. Project-scoped access doesn't do this. How Auth works.

An erasure you can defend

GDPR says delete the person. Your auditor says keep the log. Crypto-shred settles it. We destroy the subject's key material. The data goes unreadable. The chain still verifies. See the diagram.

Where Keboola is genuinely stronger

Start with the obvious. They move data. We don't. 700+ connectors. Transforms in SQL, Python, R, and Julia. Jobs, flows, CDC, data apps. That's years of connector work nobody enjoys, and everybody needs. Their finance build is real too. A chart of accounts you can actually agree on. Currency conversion. Intercompany eliminations. And they were early on agents. The MCP server went from Anthropic's announcement, in November 2024, to users' hands by May 2025. Open source, under MIT. With OAuth and its own workspace. We shipped ours in that same window. We know what that year cost.

Here's the push-back. Their June 2026 post draws the right line, between guessing AI and proven AI. Then it defines proof as a governed semantic layer. One with lineage back to the journal entry. That makes an answer easy to explain. It doesn't make it enforceable. It doesn't make the record of it provable. Say an agent reads a payroll table it should never have opened. A glossary doesn't stop the call. Lineage doesn't refuse it. A log you can edit doesn't prove what happened. Those are three separate jobs. We only claim the second and third one. Run their pipelines into your warehouse. Point your agents at checked datasets through us. Nobody has to lose.

Questions worth asking both of us

These are the questions we would ask if we were buying. Put them to every vendor on your list, including us.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. We sign checkpoints. We chain them too. Checking tells deletion apart from truncation and tampering. Try it on a sample chain at /verify. Keboola: their material describes lineage, an activity centre, and audited support access. We found no tamper-evidence method made public. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks access on each checked tool call. A pulled grant lands on the next call. The context drops to anonymous. Keboola's MCP server signs in over OAuth. It scopes access at the project level, with its own space per run. We could not find a mid-session cut-off method in their docs. Ask how long a compromised agent keeps working after you pull its access.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material. It issues an ISO 27560 consent receipt too. We commit actor identities in the chain as HMAC hashes. The proof still checks out, once the subject is gone. Keboola publishes a GDPR-aligned processing deal. Plus regional deployment, for residency. But how they erase a subject isn't spelled out. Nor is what that does to history. Ask for the method, not the policy.

Is DataShield an ELT tool? Do we drop Keboola?

No, and no. We have no connector list. No scheduler. No opinion about your NetSuite extract. Getting data from 40 systems into one place? Buy a platform that does that. Run us for the datasets agents actually query. There, the job is authorization and evidence. Plenty of teams sensibly run both.

Keboola ships an MCP server too. What's different?

Theirs opens the platform to an agent. Read storage. Write SQL. Run jobs. Build flows. Deploy data apps. It's a good build, and it was early. The agent signs in over OAuth. It works inside a project. It gets its own space. Ours is where we query the checked data itself. The tool token carries a scope ceiling. We authorize the call right then. We meter usage against the agent. The decision seals into the chain. Different jobs. Want an agent to build a pipeline? Use theirs. Want an agent to read regulated data, under proof you can check later? Use ours.

Does DataShield have SOC 2?

Not yet. We won't imply otherwise. Keboola has it: Type II, under NDA. That's fair to weigh against us. What we offer instead: a public threat model. A verifier anyone can run. Source escrow, in design-partner terms. So a small vendor isn't a single point of failure. Auth is live. Guardian and Lighthouse have run since April 2026. Details on the security page.

Keboola's current line: "Your board wants AI. Your data isn't ready." Also: "the governed data foundation CFOs deploy before AI." It says: live in eight weeks. - keboola.com, 13 Sep 2026
Free tier at $0. It gives 60 compute minutes a month, after the first month. Then $0.14 a minute over that. Time Credits bill one hour of job time each. Data Catalog, SSO, SOC 2 Type II, GDPR, and HIPAA all sit at the Enterprise tier. - keboola.com/pricing, 13 Sep 2026
Keboola's MCP server is open source under MIT. It exposes tools for storage, SQL, parts, jobs, flows and data apps. It offers a hosted OAuth endpoint, plus local stdio and HTTP transports. - github.com/keboola/mcp-server, 13 Sep 2026
MCP work started after Anthropic's November 2024 announcement. It reached proof of concept in January 2025. It was in customer use by May 2025. 30+ tools. Project-level access control. Its own workspace per run. - Keboola blog, 29 Jun 2025
A $32M Series A, led by Viking Global Investors. Presto Ventures and TCF Capital joined too. It followed a $5M seed. - Keboola blog, 1 Dec 2023
SOC 2 Type II under annual audit and available under NDA. AES-256 at rest via AWS KMS. TLS 1.2+ in transit. SAML and OAuth SSO. Single-tenant stacks with regional residency. - Keboola blog, 18 Jan 2026
Keboola defines verifiable AI as a governed semantic layer. One with lineage traced back to the source journal entry. - Keboola blog, 18 Jun 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →