Head-to-head · updated 13 September 2026
DataShield vs OpenMetadata: your catalog tells the agent what the data means. What tells it no?
OpenMetadata is, in truth, the best open-source data catalog. Right now. It's really not even close. It has more than 130 connectors. Column lineage comes right out of the box. It uses just a single metadata schema. Not a pile of aspects. It has 15,000 GitHub stars and 450 contributors. Version 2.0 landed in August 2026. The MCP server ships set up, and on by default. An agent can read your catalog. It can do that the hour you deploy it. Do you want a free catalog you can run yourself? Go download theirs. We mean that.
We took a really odd bet. DataShield Ontology has a catalog too. It's just the smaller half of the whole product. The rest is a classification kernel, with 129 field classes. Add tokenization. Add an identity control plane for agents. Add an audit chain you can check, without trusting us. We tokenize datasets right at ingest. Agents then query tokenized data over MCP. Detokenization is a privileged, audited step. Below is the honest split. It includes the rows OpenMetadata wins outright.
The short version
Pick DataShield when
- Say the data is regulated. You need PII and PHI labelled at the column level. You need tokens over the sensitive fields. You need a rule that fails closed. A catalog label is just a note, not a control.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Our chain simply answers with math. Run the verifier.
- You need to pull an agent's mid-session access. The very next tool call should fail. Not just the next token refresh. The next call.
- You want classification, tokenization, agent authorization, and evidence, from one stack you host yourself. Not four projects wired together, with you owning the seams.
Pick OpenMetadata when
- Your estate is wide. It's mostly not PostgreSQL, at all. They have more than 130 connectors, now. We have one that's GA. We're just not going to catch them.
- Lineage is the whole job. Column lineage, impact analysis, and a real UI for it. All free, today.
- Budget is zero, and it has to stay zero, always. Apache 2.0, no seat count, no asset cap, self-host forever.
- You want a really big community. 14,000 members, 450 contributors. And a Slack where someone has, quite likely, hit your bug already.
Bottom line: OpenMetadata is a catalog that learned to talk to agents. DataShield is a control plane that happens to carry a catalog. If your hardest question is simply what the data means, take theirs. If it's what the agent may do with it, and how you prove that later, take ours.
Feature by feature
Competitor cells describe what OpenMetadata's docs say. Plus GitHub releases, and the Collate site. We use the date above. If we got something wrong, email support@myorg.ai. We'll fix it and credit you.
| What matters | DataShield | OpenMetadata | Edge |
|---|---|---|---|
| Connector coverage | We scan, profile, and classify a live PostgreSQL source. Right in place. No rows ever leave it. Snowflake, BigQuery, Databricks, SQL Server, S3, and Salesforce sit on the roadmap. Now. They have no handler yet. Separately, we watch S3, Azure Blob, GCS, SFTP, and SMB. All those subtrees. We ingest new files as they land. | 130+ connectors. They span warehouses, BI tools, pipelines, ML platforms, and message queues. That's the main reason people go deploy it. | ◇ |
| Lineage | Typed lineage, over a read-only predicate vocabulary. Access gating sits at both ends of each hop. It comes from the pipelines that own the relationships. Not a stored column graph. There's simply no edge-write command. | Column lineage, with a full canvas UI. Plus service, domain, and product level views, all three. Deeper than ours. Really easier to look at, too. | ◇ |
| PII and PHI classification | 129 built-in field classes cover PII, PHI, financial data, and secrets. That includes all 18 HIPAA Safe Harbor identifiers. Plus eight non-US national ID formats too. We use regex. Plus checksum checks: Luhn, NPI, Verhoeff, ABA, IBAN, GTIN. Add column-name lexicons and anti-pattern flags. No model at all. Results stay fully repeatable, from a config digest. We cut over from shadow mode just days ago. Call it new, then. Not battle-tested. | Auto-classification tags. A glossary. OWL ontology import. All added in 2.0. You can go load a taxonomy you own now. That's just tagging. It's not a checked classification kernel. | ◆ |
| Tokenization and generalization | Deterministic, join-preserving, vault-reversible tokens, applied at ingest. We also generalize quasi-identifiers. Dates go to year, decade, or age band. ZIPs go to 3 or 4 digits. Phones, SSNs and emails get partial masking. Each column gets a measured cardinality-reduction score. Both are features you switch on yourself, not defaults. Detokenization stays privileged, and logged, always. | Simply not part of the product. The catalog just describes data. It doesn't ever transform it. | ◆ |
| Audit evidence | SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are, themselves, chained too. Verification returns one of three answers. Clean. Attested damage. Or tampered. It names insertion, deletion, and truncation, each separately. Try the verifier. | Change events, alerts, and activity feeds, all logged. We found no cryptographic tamper evidence at all. Not in their docs. Not in the release notes. | ◆ |
| Agent authorization | Each checked tool call passes a scope ceiling. It also carries a consented-tool allowlist, and an access tier. It also gets a fresh re-check, before dispatch. It just fails closed, each time. Delegation uses RFC 8693 token exchange. It always has an enforced scope ceiling. | Real RBAC. Their MCP page says agents "assume any role or policy you define," using the same authorization engine as the REST API. That's role-based access to metadata. It's checked on each request. We found no per-agent scope ceiling at all. We found no mid-session revocation either. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin access, plus IP allowlist, plus step-up too. It auto-revokes, on its own. It's fully audited, each time. | Not described anywhere, in their public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. HMAC commitments cover actor identities in the chain. The evidence still checks out once the subject is gone. | Metadata retention, plus deletion of entities. Erasure of subject data is the source system's problem. That's fair enough, for a catalog. It still leaves you with the problem, though. | ◆ |
| MCP and agents | There are more than 200 MCP tools. They spread across Ontology, Auth, Corpus, and Lighthouse. Agents query the checked data itself, not just metadata about it. Auth issues MCP tool tokens with scope ceilings. It meters each call against the agent. | A real MCP server ships set up, and on by default. That's been true since 2.0, back in August 2026. It uses OAuth, or a personal access token. It just serves catalog context. It can write right back to entities. 2.0.1 later trimmed the tool surface. It stopped unauthenticated errors from leaking their stack traces. | ◈ |
| Deployment | Self-hosted, right in your own cloud or data center. Or on a dedicated single-tenant server we run for you. Docker images cover Auth, Ontology, Corpus, and Lighthouse. A signed deploy manifest, and Guardian checks it. Ed25519 audit-signing keys stay right on your instance. They sit in a key directory you fully control. Kid-keyed rotation always fails closed, on an unknown key. KMS or HSM custody is a built seam in Auth. It's not a shipped setup yet. HMAC tokenization keys sit in your own setup today. Or they derive from your machine key. Not in a KMS, not yet. | Docker or Kubernetes, for the OSS build. Or Collate managed cloud. Or bring-your-own-cloud, on the big three. That's a wider set of options than ours. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse are live. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so. | Founded back in 2021. It raised $14.8M in total. 15,000 GitHub stars. More than 4,000 claimed big-company deployments. Collate itself lists SOC 2 Type II. Older. Bigger. More certified. All at once. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | The OSS core is free, under Apache 2.0. That just beats any price we can print. Collate's paid tiers publish seat and asset caps. Free is 5 users and 500 assets. Premium is 25 users and 5,000 assets. Enterprise is 50+ users and 10,000+ assets. No dollar figures at all, though. Enterprise-grade MCP sits right on the top tier. | ◈ |
◆ DataShield leads◇ OpenMetadata leads◈ comparable
OpenMetadata claims come from open-metadata.org and docs.open-metadata.org. Plus the project's GitHub releases, and getcollate.io. Last checked 13 September 2026. We link them below, not from memory.
Three things you get here that you won't get from an open-source catalog
Proof that survives an audit
An admin can edit a change feed. A hash chain simply can't, not quietly. Ours signs checkpoints, always, and chains those too. The verifier tells you what broke. Not just that something did. That's the property reviewers care about. Think EU AI Act Article 12. Think HIPAA §164.312(b). Try it in your browser, no signup.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job, still running. With DataShield, the next checked tool call re-checks current access. It just fails closed, each time. An RBAC role you edited Friday afternoon. It only helps you on Monday. How Auth does it.
Labels that do something
Most catalogs just tag a column PII, and stop right there. Ours binds the class to a mask type. Plus a severity, and a rule reference. Then the query path goes and acts on it. Same label, but another result. How the ontology is built.
Where OpenMetadata is genuinely stronger
We would rather you heard this from us, in truth. OpenMetadata ships more catalog than we do. It costs nothing at all. 130+ connectors against our one GA provider. That's not a gap we talk our way out of. Column lineage just works, on day one. The 2.0 release in August 2026 was a serious piece of engineering. Dynamic sampling replaced full-table scans in data quality. Governance intake forms landed too. OWL import lets you bring an ontology you run now. The MCP server now installs and runs by default. They patch fast, too. Really fast. Version 2.0.1 shipped just eight days later. It fixed an MCP error path. That path had leaked stack traces to unauthenticated callers. That's the kind of bug you only find in public. And fix in public. Not if you're not paying attention. Collate has SOC 2 Type II. We simply don't.
Here's the push-back, and it's narrow. Their MCP server just hands an agent the catalog. Roles and rules decide which metadata it sees. That's real access control, better than most catalogs offer. But the agent then goes and queries the actual warehouse. It does that through some other credential. The catalog just never sees that call. It can't refuse it, ever. It can't tokenize what comes back, either. It keeps no evidence an examiner would accept. The labels say PHI. Nothing downstream has to care, at all. If your agents only read metadata, none of this matters. Use theirs. If they read the data, the duty lands somewhere. A catalog just isn't where it lands.
Questions worth asking both of us
These are the questions we would want answered. That's if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, it can. Each record commits to the one right before it. Checkpoints are Ed25519-signed, and chained, always. Verification tells deletion apart from truncation. It tells tampering apart too. Run it against a sample chain at /verify. OpenMetadata records change events and alerts. We found no tamper-evidence mechanism at all. Not in the docs. Not in the release notes. Just ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. That check lands right on the next call. OpenMetadata uses roles and policies on the MCP surface. That's the same engine as its REST API. We just couldn't find a documented mid-session revocation path. Ask how long a token keeps working. That's after you delete the role.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material. Then it issues an ISO 27560 consent receipt. HMAC commitments cover actor identities in the chain. The evidence still checks out once the subject is gone. OpenMetadata is, after all, a catalog. Subject erasure happens in the source system. Then the catalog re-ingests. Just ask what happens to sampled values and profiles. They sit in the metadata store now.
We already run OpenMetadata. Do we rip it out?
Probably not, in truth. This is the row where we differ most. More than on our other compare pages. Both products are, after all, catalogs. Running both means two catalogs. Plus a reconciliation job nobody really enjoys. Does OpenMetadata cover your whole estate? Do your agents only read metadata? Then keep it. Bring us in for enforcement and evidence. That's for regulated datasets. Some teams do split it that way, on purpose. Their catalog covers the estate. Ours covers the datasets agents actually touch.
Is this an OpenMetadata alternative for regulated data?
For PostgreSQL sources, yes, it is. You get the catalog itself. Plus 129-class field classification, with repeatable results. Add tokens over the sensitive columns and per-call agent authorization. Add a checkable audit chain. For a wide estate of Snowflake, BigQuery, and Salesforce, no. Those provider kinds are only declared, not built. We would rather say that now. Not in week three of a live deployment.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Collate does, yes, on the managed cloud. What we offer instead: a public threat model. Plus a verifier anyone can run. Plus design-partner terms that include source escrow. That way a small vendor isn't a single point of failure. Details on the security page.
- OpenMetadata's own hero line: "The #1 open context layer for humans, AI assistants, and agents." The site lists 130+ connectors, 15,000+ GitHub stars, and 450+ contributors. - open-metadata.org, 13 Sep 2026
- OpenMetadata 2.0: the MCP server exposes catalog metadata to AI assistants. It comes enabled by default. There's OWL ontology import too. Dynamic sampling now replaces full-row scans, in data quality. Context Center now replaces Knowledge Center. - GitHub release 2.0.0-release, 24 Aug 2026
- Their MCP server "uses the same Authorization engine we have for the OpenMetadata APIs" and agents can "assume any role or policy you define." - open-metadata.org/mcp, 13 Sep 2026
- The MCP server ships installed and enabled by default. It connects via OAuth, or a personal access token. - docs.open-metadata.org MCP guide, 13 Sep 2026
- Collate pricing lists three tiers. Free: 5 users, 500 assets. Premium: 25 users, 5,000 assets. Enterprise: 50+ users, 10,000+ assets. Enterprise-grade MCP sits right on the top tier. No dollar figures on any paid plan. - getcollate.io/pricing, 13 Sep 2026
- Collate raised a $10M Series A, led by Venrock. That brought total funding to $14.8M. - PR Newswire, 15 Jul 2025
Other head-to-heads
DataShield vs DataHub
The other open-source catalog, with the same missing layer.
OSS catalogDataShield vs Amundsen
Search-first discovery, against enforcement at the tool call.
GovernanceDataShield vs Collibra
Enterprise governance workflow, plus the evidence it doesn't ship.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run, right in your browser. Break a live audit chain. Revoke an agent mid-session. Then go back to your catalog. Ask it the same two questions. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →