Head-to-head · updated 13 September 2026

DataShield vs LlamaIndex: who governs the documents your agent just parsed?

LlamaIndex is very good at the job it picked. Point LlamaParse at a scanned loan file with three rotated pages and a table that spans a fold. You get clean markdown back, for about a penny a page. Their own ExtractBench runs over 370 documents and 4,869 pages. It puts their top tier at 95.6% value F1. The framework is MIT-licensed. The docs are good. 25 million people a month download it. We use tools like this. It's not bad, and we won't tell you otherwise.

We are a different layer. DataShield is the checked data plane. The agent reads from it after parsing is done. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged, logged step. We compute embeddings locally. So no chunk of your document leaves the building to become a vector. We check each tool call against the agent's current access before it runs. Then the call seals into a hash chain you can check. Most teams who buy us keep their parser. Below is the honest split, rows they win included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

The data your agent reads is regulated. You need it tokenized or generalized before a prompt is built. Not masked after retrieval. How the data plane works.
Someone will ask you to prove an agent's access log wasn't edited. An auditor, or Article 12 of the EU AI Act. Our chain answers with math. Run the verifier.
You need to pull an agent's access mid-session. The very next tool call should fail. Not the next token refresh.
Self-hosting is the requirement, not the upgrade. Everything runs on your own infrastructure, on keys you hold, at any plan size.

Pick LlamaIndex when

Your hard problem is the document itself: scans, tables, charts, handwriting, 200-page filings. That's what LlamaParse and LlamaExtract are built for. We do none of it.
You want to start free tonight. The framework is MIT. The cloud tier gives you 10,000 credits a month. Nobody makes you talk to sales.
You need SOC 2 Type II and a signed BAA today. They have both. We don't have SOC 2 yet, and we say so.
Your team already writes against the LlamaIndex API. Hundreds of hookups and a huge community are a real asset. Switching costs are real too.

Bottom line: LlamaIndex turns your documents into text an agent can read. DataShield decides what that agent may read. It tokenizes the sensitive parts first, and keeps proof of every call. They are the parser; we are the plane the parsed data lands on. Running both is the normal answer.

Feature by feature

Competitor cells describe what LlamaIndex's site, docs, and blog say. We use the date above. Did we get something wrong? Email support@myorg.ai. We'll fix it and credit you.

What matters	DataShield	LlamaIndex	Edge
Document parsing and OCR	We extract text from PDF, DOCX, and EML files at ingest. We store it as a versioned derived file. That's text extraction, not layout-aware OCR. No vision model. No table rebuild. No handwriting.	The core product, and the best part of it. Four priced tiers, from Fast to Agentic Plus. A published benchmark over 4,869 pages. A Turbo tier added in September 2026.	◇
Structured extraction	Not our job. We profile, sort, and score the dataset once the values are in. A full analysis profile per dataset.	LlamaExtract takes a schema and returns typed fields, with confidence scores and citations. Deep Extraction handles long files.	◇
Tokenization and data handling	Deterministic, join-preserving, vault-reversible tokens, applied at ingest. Plus quasi-identifier generalization. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking. Each column gets a measured cardinality-reduction score. Turning a token back is privileged and logged.	The only PII tool is an open-source Presidio post-processor that masks text after retrieval. Their own post says "Nothing is bulletproof." We found no PII feature native to LlamaCloud.	◆
Retrieval and embeddings	Postgres pgvector, with hybrid keyword and vector search. Embeddings run locally on nomic-embed-text. So no chunk of your data goes out to be embedded. Chunk views apply read-time masking. The keyword index rebuilds from the masked text. So search can't be used to probe for a hidden value.	A hosted Index with tuned chunking, embedding, and retrieval, plus connectors. Worth knowing: they said in April 2026 they're shifting focus away from storage and retrieval. They archived the index MCP server in August.	◈
Agent authorization	Each checked tool call passes a scope ceiling. Plus a consented-tool allowlist, plus an access tier check. There's a revocation re-check before dispatch too. It fails closed. Delegation uses RFC 8693 token exchange, with an enforced scope ceiling.	The SharePoint connector writes ACL fields such as allowed_siteUser_ids onto chunks. Their guide then tells you to build an app that treats them properly. That's metadata for you to enforce. Not enforcement.	◆
Audit evidence	SHA-256 hash chain, with Ed25519-signed checkpoints. We chain those checkpoints too. Verification returns one of three verdicts. It names the exact failure: tampering, insertion, deletion, or truncation. See the demo.	OAuth login and OpenTelemetry traces on the hosted MCP server. Traces help with debugging. We found no tamper-proof method in their public docs.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes. It's IP-allowlisted and step-up gated. It can't be quietly removed from the log.	Not described in their public docs.	◆
GDPR erasure	Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. We commit actor identities in the chain as HMAC hashes. So the audit still checks out, even after the subject is gone.	Their published data-handling line: they delete cached data after 48 hours. You can switch off caching. They leave it to you: what does erasure mean for an index you built?	◆
Prompt path	We don't proxy your LLM traffic. We do gate each value that leaves a checked dataset for a prompt. A PHI dataset refuses an endpoint without a BAA. A tagged column with no set rule gets redacted. It never passes through.	Content goes to their parsers and, on the agentic tiers, to a vision model. Keeping it in your tenant means the Enterprise plan, or running LiteParse yourself.	◆
MCP and agents	More than 200 MCP tools, across Ontology, Auth, Corpus, and Lighthouse. Auth issues MCP tool tokens with scope ceilings. Each call is metered and tied to the agent.	A hosted MCP server at mcp.llamaindex.ai. Parse, Classify, Extract, Split, and upload tools, behind OAuth. Plus agent skills for Claude Code. Good reach. Six document tools, no policy layer.	◈
Deployment	Self-hosted, in your own cloud or data center. Or a dedicated single-tenant server we run. Docker images cover Auth, Ontology, Corpus, and Lighthouse. A signed deploy manifest, Guardian checks it. Ed25519 audit-signing keys sit on your instance, in a key directory you control. Rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. It's not a shipped integration yet. Tokenization keys sit in your setup today. Not in a KMS.	Multi-tenant SaaS in US and EU regions. Private VPC, hybrid, and on-prem sit on Enterprise-tier, custom-priced. LiteParse Server is free to self-host. But it's the light extractor, not the accurate one.	◆
Maturity signals	Auth, Guardian, and Lighthouse are all live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. Field classification shipped recently. Call it new, not battle-tested.	Founded 2022. $27.5M disclosed, plus Databricks and KPMG stakes. 52k GitHub stars. SOC 2 Type II. HIPAA BAAs on Enterprise. A customer list with Carlyle, KPMG, and Boeing's Jeppesen on it.	◇
Pricing	Our pricing. A scoped instant quote. No sales wall.	Published too: 1,000 credits for $1.25, Free at $0, Starter $50, Pro $500, Enterprise on request. Credit math takes a minute, but the numbers are on the page.	◈

◆ DataShield leads◇ LlamaIndex leads◈ comparable

LlamaIndex claims come from llamaindex.ai, its pricing page, and its own blog posts. Last checked 13 September 2026. We link them below, not from memory.

Three things you get here that you won't get from a document pipeline

Proof that survives an audit

A log that can be quietly edited proves nothing. Ours is a hash chain, with signed checkpoints. The verifier tells you what broke. Not just that something did. EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about exactly this. Traces are for you. Proof is for them. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job over the claims corpus. DataShield re-checks the next tool call against current access. It fails closed. A metadata field on a chunk can't do that. Nothing reads it, unless your app remembers to. How Auth does it.

Sensitive values handled before the model, not after

Masking retrieved text is the last chance to act. By then, it's already been embedded. We tokenize or generalize at ingest instead. The values an agent reads are the treated ones. Erasure works the same way. We destroy the subject's key material. The data goes unreadable. The chain still checks out. See the diagram.

Where LlamaIndex is genuinely stronger

Start with the obvious. They parse documents far better than we do. The gap isn't close. LlamaParse handles scans, rotated pages, nested tables, and charts. We read text out of PDF, DOCX, and EML files and stop there. Their September 2026 post on just-in-time OCR is smart engineering writing. Their per-page prices are public and cheap. They also win on reach. A free MIT framework. 52,000 stars. Hundreds of hookups. A hosted MCP server your agent can call today. SOC 2 Type II. HIPAA BAAs and EU data residency. If your problem is a filing cabinet, buy them and get on with it.

Here's the push-back. Their permission story stops at metadata. The SharePoint connector copies ACL fields onto chunks. The guide hands enforcement to your application. That means the control lives in code your agent can skip. Their PII story is a post-retrieval masker whose own blog post says nothing is bulletproof. And the product they're moving away from, by their own words, is the storage and retrieval layer that would carry any of this. That's a sensible business call for them. It just leaves one part sitting on your side of the line. The part a regulated buyer needs. That's the part we build.

Questions worth asking both of us

These are the questions we'd want answered, if we were buying. Ask them on each call, ours too.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are signed and chained. Verification tells deletion apart from truncation and tampering. Run it against a sample chain at /verify. LlamaIndex: their MCP server emits OpenTelemetry traces and rate-limits by user. Traces are mutable by design. Ask them what stops a trace from being edited.

What happens to a revoked agent mid-session?

DataShield re-checks access on each checked tool call. So revocation lands on the next call, and the call fails closed. LlamaIndex checks the MCP server with OAuth at login. We could not find a mid-session access re-check in their docs. Ask how long a revoked user's agent keeps parsing.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material. It issues an ISO 27560 consent receipt too. We commit actor identities in the chain as HMAC hashes. So the proof still checks out once the subject is gone. LlamaIndex publishes a 48-hour cache deletion window and lets you turn caching off. Erasing a person from an index you built with them is your problem to solve. Ask for the method.

Do we drop LlamaIndex if we buy DataShield?

No. We don't parse scanned documents. We won't pretend otherwise. The normal shape is LlamaParse or LiteParse on the ugly files. Then DataShield as the checked dataset and corpus the agent actually queries. Tokenization at ingest. A tool token on each call. If your only problem is document quality, you don't need us yet.

Their permission-aware retrieval sounds like authorization. Is it?

It's metadata. LlamaCloud's SharePoint connector writes fields like allowed_siteUser_ids onto each chunk. Their guide then says you can build an app that treats them properly. So the filter lives in your retrieval code. If an agent calls the index directly, or a developer forgets the filter, nothing refuses. Ours refuses at the tool call, before the handler runs. It writes the refusal to the chain.

What about running LlamaParse on PHI?

Ask them which tier keeps the document inside your tenant. On the agentic tiers, the page content goes to a vision model. Private VPC is an Enterprise-plan feature. They do sign BAAs at that tier. That's more than many vendors offer. On our side: we don't proxy your LLM traffic. But each value leaving a checked dataset for a prompt passes a fail-closed gate. A PHI dataset refuses an endpoint not marked BAA or zero-retention.

Does DataShield have SOC 2?

Not yet. We won't fake it. LlamaIndex has SOC 2 Type II. We don't. What we offer instead: a public threat model. A verifier you can run yourself. Source escrow in design-partner terms. A small vendor isn't a single point of failure, that way. Auth is live now. Guardian and Lighthouse have run in production since April 2026. Details on the security page.

LlamaIndex's current hero: "Turn Any Document Into AI-Ready Context," with "1B+ documents processed" and "25M+ package downloads per month." - llamaindex.ai, 13 Sep 2026
ExtractBench: 370 enterprise documents, 4,869 pages, 8 domains, 67 document types. Agentic Plus at 95.6% value F1 for 8.1 cents a page. - LlamaIndex blog, 11 Aug 2026
Hosted LlamaParse MCP server with Parse, Classify, Extract and Split behind OAuth, "shifting its focus from storage and retrieval toward document processing." - LlamaIndex blog, 29 Apr 2026
Permission-aware retrieval writes SharePoint ACL fields onto chunks, then leaves the query-time filter to the customer's own application. - LlamaIndex blog, 6 Dec 2024
Their PII guidance is an open-source Presidio post-processor applied after retrieval: "Nothing is bulletproof." - LlamaIndex blog, 13 Mar 2024
Published pricing: 1,000 credits for $1.25. Free, Starter $50/mo, Pro $500/mo, Enterprise custom with private VPC, SSO and custom BAAs. Cached data deleted after 48 hours. - llamaindex.ai/pricing, 13 Sep 2026

Other head-to-heads

Ingestion

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →