Head-to-head · updated 13 September 2026
DataShield vs Snowflake Horizon: who governs the agent once the data leaves Snowflake?
Snowflake Horizon Catalog is the control layer built into Snowflake. It says: "Govern and find data and AI assets across Snowflake and external catalogs." You get classification. Plus tag-based masking, row access policies, and column-level lineage. Plus a Trust Center. Since June 2026, also an Agent Identity feature. It checks an agent before it touches data. None of it is a line item. Your data lives in Snowflake? Horizon is on now, and it is good.
We are not a Snowflake feature. DataShield is a self-hosted plane for agents. Data and control both. It works the same in Snowflake. Or in Postgres. Or in a plain file on your own disk. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a privileged, audited step. We re-check each checked tool call. It matches against the agent's current access. We seal each decision into a hash chain. You can check it yourself, with no need to trust us. Most people reading this will run both. Below is the honest split. It includes the rows Horizon wins.
The short version
Pick DataShield when
- Someone will ask you to prove an agent's access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math. Not a policy PDF. Run the verifier.
- The reader is an agent, not a trusted analyst. Masking hands the clear value to an approved role. Tokens do not. The vault sits outside the query path.
- Your estate is not one platform. Half the sensitive data is in Snowflake. The rest is in Postgres, S3, or a vendor app you inherited.
- You want the rule engine, the vault, and the evidence to run on your infrastructure. On keys you hold. Under a price you can read on a web page.
Pick Snowflake Horizon when
- Everything that matters lives in Snowflake now. Then Horizon is the cheapest control you will ever deploy. There is nothing to deploy.
- You want labeling, masking, row access policies, and column-level lineage. All with no connector. No agent. No second system to keep in sync.
- Your users want a semantic layer. Horizon Context, Semantic Studio, and Semantic View Autopilot are real work. We ship nothing like them.
- You need SOC 2, ISO 27001, HIPAA, PCI, and FedRAMP on the platform itself, today. With a procurement path through all three cloud marketplaces.
Bottom line: Horizon governs Snowflake, and it does that well. We govern what an agent may do with data anywhere. We keep proof of each decision. Snowflake is your whole world? Start with Horizon. Are agents in production now? Is your estate mixed? Then the proof problem and the reader-trust problem both bite first.
Feature by feature
Competitor cells describe what Snowflake's public site says. Plus its docs, and press releases. As of the date above. If we got something wrong, email support@myorg.ai. We will correct it, and credit you.
| What matters | DataShield | Snowflake Horizon | Edge |
|---|---|---|---|
| Catalog and classification | We scan, profile, and classify a live PostgreSQL source. In place. No rows leave it. We label columns against 129 field classes. That covers PII, PHI, financial data, and secrets. Checksum validators back each one. Each verdict is reproducible, stamped with a config digest. That is PostgreSQL today, not your whole estate. Snowflake, BigQuery, Databricks, and S3 sit on our roadmap. No handler yet. | Native, zero-integration labeling across the account. Two tiers of tag: a semantic type, plus a privacy type. IDENTIFIER, QUASI_IDENTIFIER, or SENSITIVE. An AI mode adds LLM-assisted types. Docs publish no class count. AI mode skips tables with 300 or more columns. | ◇ |
| Data handling and tokenization | Deterministic, join-safe, vault-reversible tokens. Set at ingest. Plus quasi-identifier generalization. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking too. Each column gets a measured cardinality-reduction score. Detokenization is admin-tier, tenant-scoped work. It's blocked if the log write fails. | Tag-based dynamic masking and row access policies. Applied at query runtime, by role. The plaintext stays in the table. It comes back in full to an approved role. Good for a trusted human. Weak against a reader you cannot trust. | ◆ |
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are themselves chained. Verification returns clean, attested damage, or tampered. It names the exact failure: tampering, insertion, deletion, or truncation. Try the verifier. | Agent Identity keeps "complete audit trails of agent activity." The Cortex AI Gateway adds end-to-end records across agents. We found no public cryptographic tamper proof. | ◆ |
| Agent authorization | Each checked tool call passes a scope ceiling. Plus a consented-tool allowlist and an access tier. It also passes a metering guard. And a revoke re-check, before it goes out. The call fails closed. | Agent Identity checks the agent before data access. It applies role-based permissions. Managed MCP tools run as the connecting role, under RBAC. Read-only is on by default for SQL. The unit of access is the role, not the call. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin and IP-allowlist gated. It auto-revokes on its own. It cannot be quietly removed from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, cited to ISO/IEC 27040 and Article 17. ISO 27560 consent receipts too. The audit chain still checks out afterward. | Not described as a feature, in the docs we reviewed. Snowflake supports deletes and time travel. That is a different thing from destroying key material. | ◆ |
| MCP and agents | More than 200 MCP tools, across Ontology, Auth, Corpus, and Lighthouse. Tool tokens carry scope ceilings. Plus RFC 8693 delegation, with an enforced ceiling. Per-call metering ties back to the agent. | A managed MCP server, GA since November 2025. Five tool types, and a 50-tool cap per server. The July 2026 Cortex AI Gateway governs agent connections. Across more than 100 MCP servers. The Natoma acquisition helped that along. | ◈ |
| Lineage and semantics | Typed lineage, hop by hop. Each hop checks access. It comes from the pipelines that own the relationships. Not a stored column graph. A business glossary, built from entity types. No semantic layer. No BI metadata harvest. | Column-level lineage, now fed by the Select Star acquisition. Plus Horizon Context, Semantic Studio, and Semantic View Autopilot. This is the part we admire most. | ◇ |
| Reach beyond the platform | Self-hosted and platform-agnostic. The same tokens, rules, and chain apply to any dataset. Any dataset we ingest. Any cloud. No vendor account required. | Horizon Catalog runs on Apache Polaris. It reaches external Iceberg data. Through the Iceberg REST and Scan APIs. Real and open. But rule-writing still lives in a Snowflake account. So does the catalog itself. | ◆ |
| Deployment | Self-hosted, in your own cloud or data center. Or on a single-tenant server we run for you. Docker images cover Auth, Ontology, Corpus, and Lighthouse. A signed deploy manifest, checked by Guardian. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. Not a shipped link. HMAC tokenization keys sit in your environment today. Not in a KMS. | SaaS only, on AWS, Azure, or GCP. In a lot of regions. Excellent if you want zero operations. Not an option. Not if the rule says the data stays on your side. And the keys too. | ◈ |
| Maturity signals | Auth, Guardian, and Lighthouse are live in production. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet certified, and we say so. | Public company, thousands of enterprise customers. SOC 2 Type II. ISO 27001, HIPAA, PCI DSS, and FedRAMP, at the platform level. We cannot match any of that. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | No Horizon SKU and no Horizon price. Governance work bills as consumption. Classification runs on serverless credits. AI mode adds LLM token charges. Classifying views costs more than classifying tables. | ◆ |
◆ DataShield leads◇ Snowflake Horizon leads◈ comparable
Snowflake claims come from snowflake.com and docs.snowflake.com. Plus Snowflake's own press releases. Last checked 13 September 2026. We link them below, not just a paraphrase from memory.
Three things you get here that you won't get from a warehouse-native catalog
Proof that leaves with you
Horizon's audit trail lives in the account. The same account that bills your compute. Ours is a hash chain with signed checkpoints. The verifier names what broke. Not just that something did. It keeps checking after you export it, after you migrate. Even in front of an auditor with no Snowflake login. Try it in your browser, no signup.
A token the agent cannot resolve
Masking is a display-time control. An approved role still gets the real SSN back. An agent under a service role is an approved role. We take the value out of the dataset at ingest. We park the vault outside the query path. A hijacked agent finds stand-ins instead. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, the next checked tool call gets a fresh check. Against current access, right then. It fails closed. Not at the next token refresh. The next call. How Auth does it.
Where Snowflake Horizon is genuinely stronger
Let us be fair about the thing we are up against. It is free. It runs now, switched on. It needs no connector. Labeling, tag-based masking, row access policies, and column-level lineage. All of it applies to data that sits there already. That is a shape of value no standalone tool can copy. The June 2026 Summit release added three things. Horizon Context, Semantic Studio, and Semantic View Autopilot. A semantic layer that maintains itself is hard, useful work. They bought Select Star in November 2025. Its lineage and discovery folded straight into the catalog. They bought Natoma in May 2026. It became a gateway. One that governs agent connections, across more than 100 MCP servers. Add SOC 2, ISO, HIPAA, PCI, and FedRAMP at the platform level. That's a story we cannot answer with a roadmap.
Is your whole estate Snowflake? Then buying anything else for oversight needs a real reason.
Here is the reason. Snowflake's RBAC expresses every control it gives you. It stores that control in Snowflake's account. That is fine, until three things happen at once. Your data is not all in Snowflake. A different model governs half the estate, or nothing does. Your reader is an agent, not a trusted analyst. Masking hands the clear value back to an approved role. An examiner asks you to show the March agent logs weren't altered. That is a question about cryptography. Not about whether a log exists. Snowflake's own July 2026 release leans on identity partners. Okta, SailPoint, and Aembit, for task-scoped agent access. That tells you where they think the seam is. We think the seam sits one layer lower. It's the data the agent can reach. And the proof of what it did with it.
Questions worth asking both of us
These are the questions we would want answered. If we were the ones buying. Ask them on each call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed, and chained. The verdict tells deletion apart from truncation and from tampering. Try it on a sample chain at /verify. Snowflake: Horizon's Agent Identity promises complete audit trails. The Cortex AI Gateway records agent activity end to end. We found no public tamper-proof method. Ask them to show one. And ask who can write to the table.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. Revocation lands on the very next call. The context drops to anonymous. Snowflake evaluates RBAC as the connecting role. A revoked grant stops new work. But we could not find public mid-session revoke rules. Not for an in-flight Cortex Agent or MCP session. Ask how long a compromised agent keeps working. After you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material. Then it issues an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. The evidence still checks out, even after the subject is gone. Snowflake gives you deletes, time travel, and retention settings. That is not the same as destroying the key. The key that makes a value readable. Ask for the mechanism, not the workflow.
We're all-in on Snowflake. Do we drop Horizon?
No. That would be a silly thing for us to suggest. And a worse thing for you to do. It is on. It costs nothing extra to have. Its labeling and masking are the right controls for human analysts. Run it. Add us where the reader is an agent. Or where the data has to leave Snowflake to reach one. Or where you need proof that still checks out outside the account. Plenty of teams will sensibly run both.
Horizon now has Agent Identity and a Cortex AI Gateway. What is left for you?
Three things. It checks an agent's identity, then hands it the role's grants. We cap each call at a scope ceiling. We re-check access before it goes out. Its masking returns the clear value to an approved role. Our tokens do not resolve in the query path at all. And its trail is a log inside the platform. Ours is a chain anyone can check. There is also a plainer point. Their gateway governs agents reaching Snowflake. It does not govern the agent reaching your Postgres. Or your S3 bucket. Or your vendor's API.
Do you connect to Snowflake as a data source today?
Not as a catalog provider. Our in-place scan and profile is GA for PostgreSQL only. Snowflake, BigQuery, Databricks, and S3 are named. But they have no handler built yet. We would rather tell you that. Than let you find out in week three. What works today: ingest the data you want agents to touch. Tokenize it at ingest. Serve it over MCP, under Auth. Credentials for upstream systems sit in the Connection Vault. Under one of eight strategies. They stay encrypted at rest. Never readable back.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Snowflake has SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, and FedRAMP. That is a genuine gap. What we offer instead: a public threat model. And a verifier anyone can run. Also, design-partner terms that include source escrow. That way, a small vendor is not one point of failure. Details on the security page.
- Horizon Catalog's own positioning: "Govern and find data and AI assets across Snowflake and external catalogs." Also: "Enterprise context, lineage, data quality monitoring and AI guardrails mean every answer is traceable and trusted." - snowflake.com, 13 Sep 2026
- Summit 2026 added Horizon Context, Semantic View Autopilot, Trust Center enhancements, and Agent Identity. Agent Identity covers verified identity for agents before data access. Plus role-based permissions, and audit trails of agent activity. - Snowflake press release, 2 Jun 2026
- Cortex AI Gateway governs first- and third-party agents. Across more than 100 MCP servers. It has end-to-end audit trails. It names five task-scoped access partners. 1Password, Aembit, Okta, SailPoint, and Saviynt. - Snowflake press release, 28 Jul 2026
- Apache Polaris powers Horizon Catalog. It has Iceberg v3 support. Plus bi-directional external-engine read and write, to "a single, live, governed copy" of the data. - Snowflake press release, 2 Jun 2026
- Sensitive data classification tags columns with a semantic category and a privacy category (IDENTIFIER, QUASI_IDENTIFIER, SENSITIVE). It bills as serverless credits. It adds LLM token charges in AI mode. - docs.snowflake.com, 13 Sep 2026
- The Snowflake managed MCP server exposes five tool types. It caps a server at 50 tools. It defaults SQL execution to read-only. Authorization runs by RBAC, as the connecting role. - docs.snowflake.com, 13 Sep 2026
Other head-to-heads
DataShield vs Unity Catalog
The same argument, one lakehouse over.
Platform catalogDataShield vs Microsoft Purview
Estate-wide labels, versus authority at the tool call.
CatalogDataShield vs Select Star
The catalog Snowflake bought, and what it still doesn't enforce.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your warehouse still owes you. Demo Center access is free, with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →