Head-to-head · updated 13 September 2026

DataShield vs Soda: your checks pass, but can you prove what the agent did?

Soda is a data quality platform, and a good one. You write checks in YAML. You run them in your own pipeline, with Soda Core. Soda Cloud collects the results. Their hero line: "Stop data incidents before they hit production." That's a fair description of the product. Not a slogan. There is a real free tier. A $750 a month team tier, printed on the page. An MCP server that ships 65 tools now. They publish research in NeurIPS and JAIR. We are not going to pretend our rules engine beats theirs. We do not have one.

Here is the question we answer instead. Is this data safe to hand an agent? Can you prove what the agent did with it? Ontology profiles and classifies the datasets. Auth decides what an agent may do with them. It re-checks that, on each checked tool call. We tokenize datasets at ingest. Agents query tokenized data over MCP. Detokenization is a privileged, audited step. Here is the honest split. It includes the rows Soda wins.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Agents are reading customer tables now. Someone in legal has started asking what they read. We re-check access on each checked tool call. Then we seal the decision into a hash chain. Run the verifier.
You need the columns classified before anything moves. 129 field classes, including all 18 HIPAA Safe Harbor identifiers. Decided by regex, checksum and column-name evidence. Not a model. How the catalog works.
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. You want the next call to fail. Not the next token refresh. How Auth does it.
The control plane has to run on your own infrastructure. On keys you hold. With no metadata leaving the building.

Pick Soda when

The job is data quality. Checks, thresholds, freshness, volume, schema drift. Soda Core has 50-plus built-in check types. It runs in your own Airflow or dbt job. We ship none of that.
You want data contracts as the organising idea. Enforced at the pipeline boundary. With a copilot that drafts them for you.
You need anomaly detection and incident workflow. Their monitors, record-level anomaly detection, and Slack or Jira routing are a product. Ours do not exist.
You want to start today for nothing. Free tier, no credit card, unlimited users. $750 a month, when you outgrow it.

Bottom line: Soda tells you whether the data is fit to use. We decide whether an agent may use it. We keep proof of the decision. Plenty of teams should run both. The ones who run both usually bought Soda first.

Feature by feature

Competitor cells describe what Soda's public site and docs say. As of the date above. If we got something wrong, email support@myorg.ai. We will correct it, and credit you.

What matters	DataShield	Soda	Edge
Data quality checks	None. Profiling and scoring datasets is what we do. We do not test them against your rules. There is no check language here. No freshness SLA. No volume threshold.	The core product, and the best part of it. SodaCL-style YAML checks, 50-plus built-in types, data contracts. A CLI that runs in the pipeline you have now.	◇
Anomaly detection and incidents	Not built. We have change and drift checks on datasets. Plus a diff engine and a schema-evolution tracker. That is not the same thing. We will not dress it up.	Monitors, record-level anomaly detection, incident management. Plus routing into Slack, Jira or ServiceNow. They claim 70% fewer false positives than a Prophet baseline.	◇
Profiling and trust scoring	Every dataset gets a 20-section profile. Completeness, field stats, patterns, column semantics. Plus relationship graph, quality metrics, lineage and compliance oversight. A weighted trust KPI rolls up per entity type, domain and estate. It recomputes hourly.	Profiling, dashboards and quality scores in Soda Cloud. Driven by the checks you write.	◈
PII and PHI classification	129 field classes. Covering PII, PHI, financial data and secrets. All 18 HIPAA Safe Harbor identifiers, plus eight non-US national ID formats. Regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN). Column-name lexicons and anti-pattern suppressors too. No model, so the verdict is reproducible from a config digest. Shipped, and shipped recently.	Column attributes and a guide on managing sensitive data. We found no built-in sensitive-data classifier in their docs.	◆
Raw row handling	Catalog scans store no column values by default. Storing plaintext samples needs an explicit sign-off. It also writes an audit row. We scan and profile a live PostgreSQL source in place. No row egress. That is PostgreSQL today, not your whole estate.	Soda AI works from schema and metadata, "never your raw rows or PII." Failed row samples are different. Soda collects a sample of failing rows. By default, it stores that in Soda Cloud. You can switch that off per dataset. Or send it to your own Diagnostics Warehouse. We found no per-column masking of those samples.	◆
Tokenization	Deterministic, join-safe, vault-reversible tokens. Set at ingest. Plus quasi-identifier generalization. Dates go to year, decade or age band. ZIPs go to 3 or 4 digits. Phones, SSNs and emails get part masked. Each column gets a measured cardinality-reduction score. Detokenization stays privileged, tenant-scoped work. We log it.	Not a thing they do. Nothing in their docs suggests they claim to.	◆
Audit evidence	A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are themselves chained. Verification returns a three-valued verdict. It names the failure: tampering, insertion, deletion or truncation. Try the verifier.	Audit logs are listed as a Team tier feature. We found no description of a tamper-proof method. Ask them whether the log is hash-chained, or just a table.	◆
Agent authorization	Each checked tool call passes a scope ceiling. Plus a consented-tool allowlist and an access tier. It also passes a revoke re-check, before it goes out. Then it gets metered, and attributed to the agent. It fails closed.	Their MCP server authenticates with a Soda Cloud API key. Plus a secret. From environment variables. The docs say some tools change resources or trigger scans. They advise you to review the proposed call before approving it. That approval lives in the MCP client, not on the server.	◆
Break-glass	Scoped, time-boxed emergency access for agents. Admin and IP gated. Step-up authenticated, fully audited. It auto-revokes. It cannot be quietly deleted from the log.	Not described in their public docs.	◆
GDPR erasure	Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. Actor identities in the chain carry HMAC commitments. The evidence still checks out, even after the subject is gone.	Not described. A quality platform holding failed row samples has a real erasure question. Answer it. So ask it.	◆
MCP and agents	More than 200 MCP tools, across Ontology, Auth, Corpus and Lighthouse. Over the checked data itself. Tool tokens carry scope ceilings. Delegation uses RFC 8693 token exchange. With an enforced ceiling.	65 MCP tools, 26 read and 39 write or trigger. Across datasets, checks, contracts, monitors, runners and secrets. A genuine agent surface, shipped, and better documented than most.	◈
Identity and provisioning	SAML, OIDC, OAuth 2.1, WebAuthn passkeys. RFC 9068 tokens with JWKS rotation. Plus a Connection Vault, with eight credential strategies. No SCIM endpoint exists. We would rather say that than dodge it.	SSO, global and dataset roles, service accounts bound to runners. SCIM provisioning with Microsoft Entra ID.	◇
Deployment	Self-hosted, in your own cloud or data center. Or on a single-tenant server we run for you. Docker images cover Auth, Ontology, Corpus and Lighthouse. A signed deploy manifest, checked by Guardian. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. Not a shipped link. HMAC tokenization keys sit in your environment today, not in a KMS.	Soda Core runs in your pipeline. A self-hosted Runner deploys into your own Kubernetes, where "data stays within your network." The control plane is Soda's multi-tenant SaaS. Unless you buy private deployment, at Team tier or above.	◈
Maturity signals	Auth, Guardian and Lighthouse are live now. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet certified, and we say so.	Chicago and Brussels offices. An open-source engine with 2.4k GitHub stars. A decade of category presence, public research and a customer logo wall. Funding and founding details are not on their site.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Free at $0, Team at $750 a month, Enterprise on request. Usage is metered in Soda Processing Units. One of the more honest pricing pages in this market.	◈

◆ DataShield leads◇ Soda leads◈ comparable

Soda claims come from soda.io and docs.soda.io. Plus the sodadata/soda-core repository. Last checked 13 September 2026. We link them below, not just a paraphrase from memory.

Three things you get here that you won't get from a data quality platform

Proof that survives an audit

A log that can be silently edited proves nothing. Ours is a hash chain with signed checkpoints. The verifier names what broke. Not just that something did. That is the property reviewers care about. EU AI Act Article 12. HIPAA §164.312(b) too. Try it in your browser, no signup.

Classification before the data moves

A check tells you a column is 4% null. It does not tell you the column is a medical record number. We label columns against 129 classes, with checksums and lexicons. Then we let the masking and tokenization rules hang off that label. See the catalog.

Authority that can change mid-flight

Revoke an agent. The next checked tool call fails closed. Access gets re-read on each call. Not on the next token refresh. A quality platform will still happily run its scheduled scan. How Auth does it.

Where Soda is genuinely stronger

Soda does the thing we do not do. Soda Core is a real open-source engine, with a large installed base. It runs where your pipeline runs now. It speaks the language data engineers actually use. Checks, contracts, thresholds. Soda Cloud turns that into monitors, incidents and dashboards. The anomaly work behind it is public research, not a marketing number. Their pricing page has prices on it. Their MCP docs are clearer than most vendors manage. They tell you outright that some tools write. You are told to read the proposed call before you approve it. They also ship SCIM, which we do not.

Here is the push-back, and it is narrow. Their approval gate lives in the MCP client. The server authenticates with an API key ID and secret. Sitting in environment variables. We found no scope ceiling in the docs. No mid-session revocation. No per-agent attribution either. Thirty-nine of those 65 tools write, trigger or delete. That includes tools that manage secrets. A model on a bad day proposes a data source deletion. At 2am. A tired engineer clicks approve. The system that answers for it is the one holding the log. That is a different layer from data quality. It is the layer we sell.

Questions worth asking both of us

These are the questions we would want answered. If we were the ones buying. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed, and chained. Verification tells deletion apart from truncation and from tampering. Try it on a sample chain at /verify. Soda: audit logs appear as a Team tier feature. We found no tamper-proof method described anywhere in their public docs. Ask them whether the log is hash-chained. And who can edit the table.

What happens to a revoked agent mid-session?

DataShield re-checks access on each checked tool call. Revocation lands on the very next call. The context drops to anonymous. Soda's MCP server loads Soda Cloud credentials from environment variables at startup. We could not find a mid-session revoke path in their docs. Ask how long a revoked key keeps working. And whether a running scan stops.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material. Then it issues an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments. The chain still checks out, even after the subject is gone. Soda does not describe an erasure method. The question matters more for them than it looks. Failed row samples can put real customer rows in Soda Cloud. Ask what happens to those rows on an erasure request.

Is DataShield a data quality tool? Do we drop Soda?

No, and no. We have no check language, no monitors, no freshness SLAs, no incident management. If your problem is a broken pipeline at 3am, buy Soda. Run us for the datasets agents actually touch. Where the obligation is classification, authorization and evidence. Most teams who buy us own something like Soda now. The two do not fight.

Soda's MCP server is metadata-only. Isn't that safer than yours?

It is a sound design for a quality tool. Their blog says the AI layer works from schema and metadata, "never your raw rows or PII." But read their tools page. 65 tools, 39 of them write or trigger. That includes scan triggers and secrets management. Metadata-only is about what the agent reads. Not about what it can change. Our answer is different. Agents do query checked data. Each call carries a scope ceiling. Each call gets approved before it goes out. Then it gets sealed into the chain. Ask both of us to show the enforcement point, not the intent.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run since April 2026. Design-partner terms include source escrow. That way a small vendor is not a single point of failure. Details on the security page. We found no SOC 2 or ISO 27001 statement on Soda's public pages either. So ask them too.

Soda's hero: "Stop data incidents before they hit production." Record-level anomaly detection. "70% fewer false positives" against a Prophet baseline. Published research in NeurIPS, JAIR and ACML. - soda.io homepage, 13 Sep 2026
Published pricing: Free at $0 a month, with pay-as-you-go Soda Processing Units. Team at $750 a month, with SSO, RBAC, audit logs and private deployment. Enterprise on request. - soda.io/pricing, 13 Sep 2026
"Soda AI works from your schema, metadata, and contracts, never your raw rows or PII," with a propose-then-approve flow: "it drafts a contract or suggests a fix, and you approve the change before anything takes effect." - Soda blog, CLI vs API vs MCP, 3 Jul 2026
With 65 tools, 26 read and 39 write or trigger, Soda MCP spans datasets, checks, contracts, monitors, data sources, runners and secrets. - docs.soda.io, Soda MCP tools, 13 Sep 2026
Soda MCP authenticates with SODA_API_KEY_ID and SODA_API_KEY_SECRET from environment variables. The docs advise reviewing "the client's proposed tool call before approving write, delete, or trigger actions." - docs.soda.io, Soda MCP, 13 Sep 2026
"Soda automatically collects a sample of the failing rows." By default, it stores that subset of monitored data in Soda Cloud. It can be disabled per data source. Or redirected to a customer-owned Diagnostics Warehouse. - docs.soda.io, failed row samples, 13 Sep 2026
Soda Core describes itself as the "Data Contracts engine for the modern data stack." It has 2.4k GitHub stars. It has connectors for eleven systems. PostgreSQL, Snowflake, BigQuery, Databricks, DuckDB, Redshift, Trino, Spark, SQL Server, Fabric and Athena. - github.com/sodadata/soda-core, 13 Sep 2026

Other head-to-heads

Data quality

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →