Head-to-head · updated 13 September 2026
DataShield vs MotherDuck: same DuckDB engine, very different job
MotherDuck took DuckDB. It made DuckDB a serverless data warehouse. Their pitch is blunt. It is mostly right. Here it is: "faster and significantly less expensive than Snowflake, BigQuery or Redshift, designed for humans, agents and applications." So, every user gets an isolated DuckDB instance. So does every agent. It starts in about 100ms. They ship an MCP server. It has read and write access. They add agent-built pipelines and a CLI. They even ship a signup endpoint. An agent can POST to it on its own. Their pricing page lists every rate. We like this company.
We run DuckDB too. Ours sits over Parquet. It reads masked golden views. Those views stay masked. That holds whether or not anyone switched masking on. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a checked, logged step. Same engine, different job. They sell you warehouse capacity. We sell the checked surface an agent may touch. We add proof it stayed inside the lines. Most teams could run both.
The short version
Pick DataShield when
- The rows an agent queries may carry PHI or regulated PII. Someone has to say what the agent saw. We check fields against 129 built-in classes. Then we serve masked views. How the ontology layer works.
- You need to pull an agent's access mid-session. You need the very next tool call to fail. Not the next token refresh. The next call. Auth does this.
- An examiner will ask you to prove the access log was not edited. Our chain answers with math you can run yourself. Try the verifier.
- The data cannot leave your building. We ship Docker images. You run them self-hosted. Or we run a dedicated single-tenant server for you.
Pick MotherDuck when
- You want a warehouse, not a control layer. They are cheaper than the big three. They are faster too, for small and mid-size data. They publish the benchmarks.
- Elasticity matters to you. Each user or agent gets a Duckling. It is up in 100ms. It is down when idle. That is a genuinely good design. We do not do it.
- Your agents build as well as read. Flights run scheduled Python jobs. Dives make shareable charts. The Tower acquisition in August 2026 bought exactly that.
- You need SOC 2 Type II today. They have it. We do not. We will not pretend.
Bottom line: MotherDuck is where agents run fast, cheap SQL. DataShield is where agents run SQL you can defend. Is your data boring? Buy the duck. Would one column ruin your week in front of a regulator? Put us in front of that column.
Feature by feature
Competitor cells describe MotherDuck's public site, docs and blog. This is as of the date above. Did we get something wrong? Email support@myorg.ai. We will fix it and credit you.
| What matters | DataShield | MotherDuck | Edge |
|---|---|---|---|
| Query engine | DuckDB over Parquet. Single node, columnar, fast. It is fast on the shapes agents ask for. An attach relation reads masked golden views. The engine never sees raw values on that path. | DuckDB, serverless, with hypertenancy. Every user gets an isolated instance. So does every agent. It starts in about 100ms. It stops when idle. Paid tiers add read-scaling replicas. | ◈ |
| Warehouse economics and scale | You size your own box. No autoscaling, no per-second billing, no replica fleet. | The whole product. Five instance types run. Prices span $0.60 to $24.00 an hour. Storage costs $0.04 per GB a month. The free tier is actually usable. Together AI runs 128 self-service users. It spans 40 read-scaling replicas. | ◇ |
| PII and PHI handling | Field classification checks 129 classes. That covers all 18 HIPAA Safe Harbor identifiers. It uses regex, checksum checks, column-name lexicons and anti-pattern suppressors. A config digest fixes each verdict. Run it again, get the same result. Masked golden views mask every time. | We found none. No classification, tokenization, redaction or generalization shows up in their docs. None shows up in their blog either, at any tier. An agent with a grant sees the raw rows. | ◆ |
| Tokenization | We apply tokens at ingest. They stay fixed, join-preserving and vault-reversible. We also generalize quasi-identifiers. Dates become year, decade or age band. ZIPs become 3 or 4 digits. We also generalize partial phones, SSNs and emails. Each column gets a cardinality-reduction score. Detokenization needs access. It stays tenant-scoped. We log every one. The lookup fails if the audit write fails. | Not vocabulary they use. They encrypt secrets and scope them per user. That is a different thing. | ◆ |
| Audit evidence | SHA-256 hash chain. Checkpoints are Ed25519-signed. The checkpoints chain to each other too. The check returns clean, attested damage, or tampered. It names the failure: tampering, insertion, deletion or truncation. Run it. | Query history on Business and above. It is a QUERY_HISTORY view, plus Duckling-level activity monitoring. Useful, and a normal database view. We found no tamper-evidence check. | ◆ |
| Agent authorization | Every checked tool call on Auth passes four checks. It passes them before dispatch. The checks: mid-session access recheck, a consented-tool allowlist, a scope ceiling, an access tier. We then meter it. We seal the decision into an audit row. It fails closed. | RBAC with Admin, Builder and Explorer roles. Business and above add custom roles. Table-level security applies on shared databases. It uses GRANT and REVOKE on shares. This is grant-time access control. We found no per-call decision point. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It is admin and IP-allowlist gated. It is step-up verified and fully audited. It auto-revokes too. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred destroys the subject's key. That destroys every ciphertext for that subject at once. We also issue ISO 27560 consent receipts. The audit chain still checks out after. We HMAC-commit actor identities. So the chain holds. | GDPR and CCPA controls cover residency, transfers and erasure rights. EU regions sit in Frankfurt and Dublin. They do not describe the erasure mechanism itself. | ◆ |
| MCP and agents | More than 200 MCP tools span Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens. Each token carries a scope ceiling. We meter every call. We attribute each call to the agent. Delegation uses RFC 8693 token exchange. It has an enforced ceiling. | A real MCP server. It has fuzzy catalog search, query guidelines, shares, and read plus write access. An agent can persist results back. Agents can also sign themselves up. A POST to new.motherduck.com returns a token. It also returns a claim URL. That is a better onboarding story than ours. | ◇ |
| Context for agents | A catalog with a business glossary from entity types. It has typed lineage with per-hop access gating. It adds stewardship worklists. We build it for control first. Agent prompting comes second. | Guides: markdown context objects. They stay versioned and queryable in the warehouse, with org-level and user-level ownership. They add topic tags too. Agents can search across hundreds of them. A neat idea, shipped July 2026. | ◇ |
| Deployment | Self-hosted in your own cloud or data center. Or use a dedicated single-tenant server we run for you. Ed25519 audit-signing keys stay on your instance. They live in a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. It is not a shipped integration yet. HMAC tokenization keys sit in your setup today. Or they derive from your machine key. They do not sit in a KMS. | SaaS only. Data lives in MotherDuck's AWS setup. Enterprise adds region choice, PrivateLink and IP allowlisting. There is no self-hosted MotherDuck. You only get raw DuckDB without the managed parts. | ◆ |
| Certifications | SOC 2 not yet certified, and we say so on every page. | SOC 2 Type II covering security, availability and confidentiality. HIPAA BAA on Enterprise by request. AES-256 at rest, TLS 1.2 or higher in transit. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse went live in April 2026. Field classification just cut over from shadow mode this month. It is new. We would rather you knew. | Founded 2022, GA June 2024, around $100M raised. A first acquisition came in August 2026. They keep a named customer list. They run their own conference in November 2026. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Fully public down to the instance-hour. Lite is free. Business costs $250 per org a month, plus usage. Enterprise is custom. Rare honesty for a warehouse vendor. | ◈ |
◆ DataShield leads◇ MotherDuck leads◈ comparable
MotherDuck claims here come from motherduck.com, its docs and its blog. We last checked on 13 September 2026. We link the pages below, and we do not work from memory.
Three things you get here that you won't get from a managed warehouse
Masking that does not depend on a setting
Our masked golden views mask every time. They do not check the deployment setup. That was the one switch nobody would remember to flip. The DuckDB attach surface reads those views. An agent asks for a customer table. It gets the masked shape by construction. What the ontology layer serves.
Authority that can change mid-flight
An analyst hands in their notice on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, the next checked tool call rechecks access. It fails closed. A warehouse with grant-time RBAC keeps serving rows. It serves rows until someone runs a REVOKE. How Auth does it.
Proof an examiner can check without you
Query history is a table. Someone can write to a table. Our log is a hash chain with signed checkpoints. The verifier tells you what broke. It does not just say something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Break a chain in your browser.
Where MotherDuck is genuinely stronger
Almost everything about being a warehouse. Hypertenancy is a smart design. We have nothing like it. It spins up a fresh DuckDB per agent. That takes 100ms. It scales by replica. It bills by the second. Then it disappears. Their agent ergonomics beat ours across the board. An agent can POST to an endpoint. It gets its own database back. There are no credentials to fumble. There is no human in the loop. Guides put versioned context in the warehouse. That is where the queries already live. Flights let an agent write a pipeline, not just a SELECT. They bought Tower in August 2026. That made the idea real, not just a roadmap slide. They hold SOC 2 Type II. They offer a HIPAA BAA on Enterprise too. That is more paper than we carry.
Their September 2026 numbers on agent behavior matter. They are the most useful public data anyone has published. It shows what agents actually do to a database. Agents run 29 times more queries than humans do. A median agent query scans 7,000 rows. A human query scans 200,000.
Here is the push-back. It follows from their own number. Agents now run 29 times the queries humans do. They run them in four-second bursts. So the question of what those queries returned matters. It stops being a footnote. Their stack answers it with a role grant and a history view. Nothing in their material classifies a column as PHI. Nothing masks it before it lands in a model's context either. The agent's access never gets rechecked at the call. There's no record an auditor can check on their own. No one has to trust the vendor's database first. That is not a knock on their product. It is a description of a different product. It is the one we build. Run their warehouse for data that does not scare you. Run ours in front of data that does.
Questions worth asking both of us
These are the questions we would ask if we were buying. Ask them on every call. Ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained. The check separates deletion from truncation and from tampering. Re-tampering a chain that was already marked damaged un-marks it. So you cannot launder a break. Run it at /verify. MotherDuck: query history and Duckling activity monitoring on Business and above. It is a view over a database. Ask them who can write to it.
What happens to a revoked agent mid-session?
DataShield rechecks access on every checked tool call. Revocation lands on the next call. The context then drops to anonymous. MotherDuck uses RBAC with GRANT and REVOKE. It adds table-level security on shares. We could not find a mid-session check point in their docs. So ask them two things. How long does a running agent keep querying after you revoke it? Is an open Duckling affected at all?
How does GDPR erasure interact with the audit trail?
DataShield destroys the subject's key material. That makes every ciphertext for that subject unreadable at once. We also issue an ISO 27560 consent receipt. We HMAC-commit actor identities in the chain. So the proof still checks out. MotherDuck lists GDPR and CCPA controls. That includes erasure rights and EU regions. They do not describe the mechanism behind the right. Ask for the mechanism, not the policy page.
You both run DuckDB. What actually differs?
The engine is the same idea. The plumbing is not. Theirs runs managed and serverless. It is elastic too. It runs over their storage in AWS. Ours is DuckDB over Parquet. It runs in your own setup. The attach relation reads golden views. Those views mask every time, not base tables. So the difference shows up in what a query can return. It does not show up in how fast the query runs. Want capacity? They are better at capacity. Want a query surface where the sensitive columns are already handled? That is ours.
Is DataShield a MotherDuck alternative, or do we run both?
Mostly both. We are not a warehouse. We do no autoscaling, and run no replica fleet. Per-second billing isn't something we do either. We will not beat them on general analytics pricing. Put the regulated datasets behind us instead. Classification, masking, tokenization, per-call authorization and the audit chain all apply there. Leave the rest where the economics are better. The overlap is narrow. Agents query an analytical database over MCP. That is the one place we would ask you to compare us directly.
Does DataShield have SOC 2?
Not yet. MotherDuck does. So this row goes to them. What we offer instead: a checkable system. That means a public threat model. It means a verifier anyone can run. It means Docker images with a signed deploy manifest. Guardian checks that manifest. Design-partner terms include source escrow too. So a small vendor is not a single point of failure. Details on the security page.
- MotherDuck's positioning: a serverless data warehouse built on DuckDB. It is "designed for humans, agents and applications." Each user or agent gets a Duckling. It starts in about 100ms. - motherduck.com, 13 Sep 2026
- SOC 2 Type II certification. HIPAA BAA on Enterprise by request. AES-256 at rest. TLS 1.2 or higher. RBAC roles. QUERY_HISTORY view. PrivateLink on Enterprise. EU regions in Frankfurt and Dublin. - MotherDuck docs, security concepts, 13 Sep 2026
- Public pricing: Lite is free. Business costs $250 per org per month, plus usage. Enterprise is custom. Compute runs $0.60 to $24.00 per hour. Storage costs $0.04 per GB per month. - motherduck.com pricing, 13 Sep 2026
- Agents ran 29 times more queries than humans last month. That is up from 6x, then 16x. A median agent query scans 7,000 rows. A human query scans 200,000. - MotherDuck blog, 2 Sep 2026
- MotherDuck acquires Tower for runtime infrastructure. It adds sandboxing, scheduling and observability: "Agents Can Answer. Now They Can Build." - MotherDuck blog, 25 Aug 2026
- Agents can sign themselves up. A POST to new.motherduck.com returns a token. It also returns a claim URL. The agent gets "no credentials, no shell, no network." - MotherDuck blog, 10 Aug 2026
- Guides put versioned, queryable markdown context in the warehouse. Org and user level own each one. Agents can search it. - MotherDuck blog, 29 Jul 2026
Other head-to-heads
DataShield vs Snowflake Cortex Search
Retrieval inside the warehouse, versus governance in front of it.
Vector DBDataShield vs Pinecone
Retrieval at scale, and the masking step it leaves to you.
Vector DBDataShield vs Weaviate
Open-source search, plus the evidence layer agents need.
AllEvery comparison
One honest scorecard per vendor.
See the mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask your warehouse what it would have done. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →