Head-to-head · updated 13 September 2026

DataShield vs Milvus / Zilliz: who governs the text before it becomes a vector?

Milvus is a very good vector database. It's Apache 2.0. It graduated in the LF AI & Data Foundation. It will hold a billion vectors without complaining. Zilliz sells the managed version. Now it calls the whole thing a "Vector Lakebase for Enterprise AI, Powered by Milvus." Milvus 3.0 shipped in July 2026. It indexes Parquet, Lance, and Iceberg files where they already sit. So you stop paying to keep a second copy. If your problem is retrieval scale, that's a fine answer. We won't talk you out of it.

We are not a faster index. DataShield's RAG runs on pgvector, with local embeddings. It bolts to the rest of a checked data stack. We classify text before we embed it. We tokenize datasets at ingest. Agents query the tokenized data over MCP. Reversing a token is a special, audited step. We recheck each checked tool call against the agent's current access. The choice seals into a hash chain. You can check it without trusting us. Below is the split. It includes the rows Milvus wins outright.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

The corpus has PHI or customer records in it. Someone needs the sensitive fields handled before the text is embedded. We classify against 129 field classes, then tokenize at ingest.
Someone will eventually ask you to prove an agent's retrieval log was not edited. Our chain answers with math, not a policy PDF. Run the verifier.
You need to pull an agent's access mid-session. You need the very next tool call to fail. Not the next token refresh. The next call.
You want retrieval, catalog, classification, tokenization, and proof in one self-hosted stack. Not five products you glue together.

Pick Milvus / Zilliz when

Scale is the whole problem. A billion vectors, tight latency limits, and real choice of index type. That's what Milvus was built for. We won't match it.
You want the data to stay in the lake. Milvus 3.0 external collections index Parquet, Lance, Iceberg, and Vortex files in place. Read-only and zero-copy. No one else we track does that as cleanly.
You want an Apache 2.0 engine, with a large community and foundation backing. So the thing outlives any one vendor's fundraising.
You want managed operations with an SLA. Zilliz Cloud's compliance list already checks your procurement boxes.

Bottom line: Milvus stores vectors well. It has no opinion about what was in the text before it became one. If your corpus is public documentation, that is fine. If it is patient notes, the obligation lands somewhere, and a vector index is not where it lands.

Feature by feature

Competitor cells describe what the Milvus docs, the Milvus blog, and Zilliz's public material say. That's as of the date above. If we got something wrong, email support@myorg.ai. We'll fix it, and credit you.

What matters	DataShield	Milvus / Zilliz	Edge
Vector search at scale	pgvector, with 768-dimension vectors. One chunk table per corpus. Hybrid retrieval runs a keyword leg and a vector leg together. Good for checked corpora. Not a billion-vector engine. We publish no retrieval accuracy number. We haven't benchmarked one.	The core product, and very strong. Multiple index types, horizontal scaling, and a 3.0 release. It adds faster sparse retrieval and server-side ranking.	◇
Lake-native retrieval	We ingest into a checked dataset. Analytics run on DuckDB over Parquet. But that reads our masked golden views, not your lake.	Milvus 3.0 external collections index data that stays in object storage, in open formats, zero-copy. Plus snapshots and a Spark connector. Genuinely good engineering.	◇
Classification before embedding	129 field classes. Think PII, PHI, money data, and secrets. It's set, with checksum checks. Verdicts repeat, stamped with a config digest. All 18 HIPAA Safe Harbor IDs are their own classes.	None. Milvus indexes the vectors and metadata you hand it. What was in the source text is your problem.	◆
Tokenization and data handling	Set, join-safe tokens, made at ingest. Held in a vault we can reverse. Plus quasi-identifier generalization. Dates cut to year, decade, or age band. ZIP codes cut to 3 or 4 digits. Phones, SSNs, and emails cut too. Each column gets a measured score for the cut. Reversing a token is a special, logged step.	Not part of the product. Encryption at rest and in transit on Zilliz Cloud. That's a different thing.	◆
Embeddings	Local nomic-embed-text, 768 dimensions, running on your own system. No embedding call leaves the building.	Bring your own. Self-hosted Milvus can sit behind a local model too. So this is a tie on the engine. On Zilliz Cloud, ask where the embedding call goes.	◈
Agent authorization	Every checked tool call passes four gates. A scope ceiling. A consented-tool allowlist. An access tier. A check for revoke. It fails closed.	RBAC with users, roles, privileges, and privilege groups. Plus a built-in admin role. That's database-level access control. It gets checked when the connection is made. It's not a per-call decision against an agent's current access.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. MCP tool tokens carry scope ceilings. Per-call metering pins to the agent.	A real first-party MCP server. It exposes search and query. Plus create collection, insert data, and delete entities. All of it sits behind one optional MILVUS_TOKEN env variable. One static credential, read and write.	◆
Audit evidence	A SHA-256 hash chain, with Ed25519-signed checkpoints. The checkpoints chain too. A check returns clean, attested damage, or tampered. It names the failure mode. See how.	Zilliz Cloud lists audit logs among its enterprise features. We found no published tamper-proof mechanism. Open-source Milvus doesn't ship one.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes. No one can quietly delete it from the log.	Not described in their public material.	◆
GDPR erasure	We crypto-shred each subject's keys. We add an ISO 27560 consent receipt. The audit chain still checks out after.	You can delete entities. Did the subject's data also leave each index? Each snapshot? Each external collection? Worth asking. Especially now that snapshots record point-in-time views.	◆
Deployment	Self-hosted, in your own cloud or data center. Or a dedicated single-tenant server we run. Docker images for Auth, Ontology, Corpus, and Lighthouse. A signed deploy file, checked by Guardian. Ed25519 audit-signing keys stay on your instance. They sit in a key folder you control. An unknown key fails closed. KMS or HSM custody is a built seam in Auth. It's not a shipped link. HMAC tokenization keys sit in your setup today, not in a KMS.	Apache 2.0 self-hosting, with no control-plane tie. Or Zilliz Cloud serverless, dedicated, and BYOC. Both good options.	◈
Maturity signals	Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet certified. We say so.	Milvus open-sourced in 2019. It's a graduated LF AI & Data project. Zilliz was founded in 2017, with around $113M raised. Zilliz Cloud self-reports SOC 2 Type II and ISO 27001. Much longer track record than ours.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Milvus is free under Apache 2.0. That's hard to beat. Zilliz Cloud publishes use-based pricing. Storage is set at $0.04 per GB per month, across AWS, Azure, and GCP, from 1 January 2026. Enterprise is quote-only.	◈

◆ DataShield leads◇ Milvus / Zilliz leads◈ comparable

Milvus and Zilliz claims come from milvus.io docs and blog posts. Also the zilliztech/mcp-server-milvus repository, and zilliz.com. We last checked 13 September 2026. We link them below, rather than work from memory.

Three things you get here that you won't get from a vector database

The sensitive fields handled before the embedding

An embedding is not a safe container. It's derived from the text. And the text had a medical record number in it. We classify the source columns first. Then we tokenize at ingest. So the string that reaches the model is already a token. How the data plane works.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute retrieval job. With DataShield, the next checked tool call gets rechecked against current access. It fails closed. A database role grant doesn't do that. No one rereads it until the next connection. How Auth does it.

Proof that survives an audit

A log that can be silently edited proves nothing. Ours is a hash chain with signed checkpoints. The verifier tells you what broke. Not just that something did. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Where Milvus / Zilliz is genuinely stronger

Retrieval is their craft, and it shows. Milvus 3.0 landed in July 2026. It brought lake-native indexing. It added zero-copy external collections over Parquet, Lance, Iceberg, and Vortex. Plus point-in-time snapshots, a Spark connector, and server-side rollups. Then they spent August publishing the engineering detail behind each piece. That's what a team does. It expects other engineers to read it. The index-type choice is real. You can tune recall against cost. At a scale we've never been asked to reach. The licence is Apache 2.0. The project runs under a foundation. So your dependency isn't one company's cap table. And the storage price cut to a flat rate across three clouds. That's the kind of unglamorous work that makes a procurement team's year.

Here's the push-back, and it's narrow on purpose. Milvus controls the index. It doesn't control the corpus. Their own MCP server hands an agent search and query. Also create collection, insert data, and delete entities. All of it sits behind one optional token. That's a fine dev default. It's a bad production posture for a checked corpus. RBAC answers who connected. It doesn't answer whether this call is still allowed. Not this agent, not right now. And it leaves no artifact an examiner can check on their own. Gartner expects most unauthorized agent moves, through 2028, to be internal policy breaks. Not attacks. That's exactly the case a connection-time role grant handles worst. Run Milvus for the index. Put the duty somewhere it can actually be enforced, and proved.

Questions worth asking both of us

These are the questions we'd want answered if we were the buyer. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are signed and chained. A check tells deletion apart from truncation and from tampering. Try it at /verify. Milvus / Zilliz: Zilliz Cloud lists audit logs as an enterprise feature. We found no published tamper-proof mechanism in their docs. The open-source engine has none. Ask them to show you one.

What happens to a revoked agent mid-session?

DataShield rechecks access on each checked tool call. So a revoke lands on the next call. Milvus has users, roles, privileges, and privilege groups. Revoking a role is a database operation. We couldn't find docs on how an in-flight agent session is hit. Ask how long a compromised agent keeps retrieving. That's after you pull its access.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds each subject's keys. It issues an ISO 27560 consent receipt. Actor names in the chain are HMAC-committed. So the proof still checks out once the subject is gone. Milvus gives you delete entities. Ask what happens to the vectors made from that subject's text. Also ask about older snapshots. And any external collection built over files you don't control.

Is DataShield a Milvus alternative? Do we rip out our vector database?

Usually not. Say you already run Milvus at scale. Say the corpus isn't sensitive. Keep it. We're worth a look when the corpus is sensitive. Then the job is classification, tokenization, per-call authorization, and proof. A vector index does none of those. Plenty of teams will sensibly run both. Milvus for the index. Us for the checked datasets and the proof.

Milvus 3.0 indexes data in the lake without moving it. Can you do that?

No, and we won't pretend the workaround is equal. We ingest into a checked dataset. That's the point. The classification, tokenization, and access checks happen on the way in. External collections are read-only indexes over files whose contents no one inspected. That's a great fit for a product catalogue. A poor one for an HR export. Different trade, honestly made.

Does DataShield have SOC 2?

Not yet. We won't say otherwise. Zilliz self-reports SOC 2 Type II and ISO 27001. On a procurement checklist, that beats us today. What we offer instead is a public threat model. Also a verifier you can run. Design-partner terms include source escrow. So a small vendor isn't a single point of failure. Details on the security page.

Milvus 3.0, announced 27 July 2026: lake-native vector search, zero-copy external collections, snapshots, Spark connector, faster sparse retrieval. - milvus.io blog, 27 Jul 2026
External collections index data that stays in object storage in open formats, read-only and zero-copy. - milvus.io blog, 24 Aug 2026
The first-party MCP server exposes search and query. Also create collection, insert data, and delete entities. Authentication runs via an optional MILVUS_TOKEN env variable. - zilliztech/mcp-server-milvus, 13 Sep 2026
Milvus access control is users, roles, privileges and privilege groups. A built-in admin role covers all operations. - milvus.io docs, 13 Sep 2026
Zilliz's current positioning: "Zilliz Vector Lakebase for Enterprise AI, Powered by Milvus." - zilliz.com, 13 Sep 2026
Zilliz Cloud tiered storage and a business continuity plan. Storage is set at $0.04 per GB per month, across AWS, Azure, and GCP, from 1 January 2026. - zilliz.com blog, Oct 2025

Other head-to-heads

Vector DB

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →