Head-to-head · updated 13 September 2026
DataShield vs Starburst: your agent can reach the data, but may it?
Starburst is the company behind Trino, and it shows. Point Starburst Galaxy at a warehouse, an Iceberg lake, a Postgres box and an S3 bucket. Join across all of them in one query. No pipeline first. Their hero line is "Stop moving data. Start using it." That is a real build position. They have held it for years. The logo wall backs it up. On top sits AIDA, their natural-language agent. There's also a hosted MCP server for other people's agents. The MCP work is careful, too. OAuth 2.1. The agent takes on the logged-in user's access. Any write gets blocked at parse time, before a cluster sees it.
We do not write a query engine. We won't pretend we federate your estate. DataShield governs the datasets agents read. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Detokenization is a special, audited step. Fields get classified into 129 built-in classes: PII, PHI, financial, secret. Each checked tool call gets checked against the agent's current access before it runs. The decision gets sealed into a hash chain you can verify yourself. Starburst answers whether an agent can reach the data. We answer whether it may. We also answer whether you can prove that in a year.
The short version
Pick DataShield when
- The values themselves are the problem. We tokenize at ingest. An agent joins on a token. It never reads the SSN behind it. How the data plane works.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Our chain answers with math. Run the verifier.
- You need to pull an agent's access mid-session. The very next tool call should fail. Not the next token refresh.
- You want a price before you book a call. No per-credit meter runs while an agent thinks.
Pick Starburst when
- Your data lives in eight systems. Moving it is not on the table. Federated SQL is the whole point of the company. They are very good at it.
- You are building an open lakehouse on Iceberg. Their Icehouse work, table maintenance and Warp Speed caching are years ahead of anything we would attempt.
- Analysts want to ask questions in English and get charts back. AIDA is aimed squarely at that. Skills let your own team teach it domain tricks.
- You already run Trino and want the commercial version. That means ABAC, SCIM and a support contract, all attached.
Bottom line: Starburst decides which tables an agent may query. DataShield decides what the agent may do with the values inside them. It also keeps proof of the decision. Teams with agents already touching regulated data usually meet the second question. That's when the auditor arrives.
Feature by feature
Competitor cells describe what Starburst's public site and blog say as of the date above. If we got something wrong, email support@myorg.ai. We will fix it, credited.
| What matters | DataShield | Starburst | Edge |
|---|---|---|---|
| Federated query across systems | Not our job. We ingest datasets into a checked plane. Our catalog scans a live PostgreSQL source in place. Snowflake, BigQuery, Databricks, S3 and Salesforce sit on the roadmap. No handler yet. | The product. Dozens of connectors, cross-system joins, no data movement, proven at large scale. Warp Speed caching and Iceberg table maintenance on top. | ◇ |
| Field-level PII and PHI classification | 129 built-in classes cover PII, PHI, financial data and secrets. That includes all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. We use regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), column-name lexicons and anti-pattern suppressors. No model, so verdicts stay reproducible from a config digest. | Column masking and row filters at query time, driven by rules you write. We found no built-in sensitive-field classifier in their public docs. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens, applied at ingest. Plus quasi-identifier generalization: dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking too, with a measured cardinality-reduction score per column. | Masking hides a value from a viewer. It is not reversible under any rule. It is not even a word they use. Nothing we found tokenizes before a model reads the result. | ◆ |
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. The checkpoints are chained too. Checking it returns clean, attested damage, or tampered. It names the failure: tampering, insertion, deletion or truncation. Try the verifier. | Each MCP step lands in the Galaxy audit log. It's tagged as an MCP query, with the client user agent and a trace token. Good logs. We found no crypto tamper proof over it. | ◆ |
| Agent authorization | Each checked tool call passes a scope ceiling, a consented-tool allowlist, and an access tier. It gets a revocation re-check before dispatch, too. It fails closed. Delegation is RFC 8693 token exchange with an enforced scope ceiling. | The agent runs as the logged-in user, under Gravity RBAC and ABAC, view-only. Writes get blocked at parse time. That is a sound design. It also means the agent's reach equals one person's reach, all session long. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin plus IP allowlist plus step-up, auto-revoking, and it cannot be quietly removed from the log. | Not described in their public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key docs, plus ISO 27560 consent receipts. Actor identities in the chain carry HMAC commitments, not names. The audit still verifies after the subject is gone. | A query engine erases nothing. Deletion happens in the systems below. That's honest, but it leaves the job with you. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings. Each call gets metered and attributed to the agent. | A hosted MCP server in Galaxy since April 2026. OAuth 2.1, no open sign-up on purpose, view-only rules, result-size limits. Narrow by design, and well built. | ◈ |
| Natural-language analytics | We have none. Agents query checked datasets over MCP. You bring your own model. | AIDA turns questions into SQL. It cites its sources and builds dashboards. Skills let customers add domain skill in an open file format. They run under the invoking user's own access. Guardrails add four toggles, including prompt-injection defence and topic blocks. | ◇ |
| Prompt path | We do not proxy your LLM traffic. We do gate each value that leaves a checked dataset for a prompt. A PHI dataset refuses an endpoint without a BAA. Local embeddings handle RAG, so nothing leaves for a third party to vectorise. | Guardrails filter the agent's behaviour: instruction extraction, data-borne injection, prompt length, banned topics. Their own post calls it a behavioural layer above the built-in controls. | ◈ |
| Deployment | Self-hosted, in your own cloud or data center. Or a single-tenant server we run for you. Docker images cover Auth, Ontology, Corpus and Lighthouse. Guardian checks each one against a signed deploy manifest. Ed25519 audit-signing keys stay on your box, in a key folder you control. Keys rotate by kid, and an unknown key fails closed. KMS or HSM custody is a built seam in Auth, not a shipped link. HMAC tokenization keys sit in your setup today, not in a KMS. | Galaxy as SaaS, Starburst Enterprise self-managed and on-prem, AWS Marketplace. Open-source Trino sits below, if you want zero vendor at all. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse run live in production (Guardian and Lighthouse since April 2026). SOC 2 isn't certified yet, and we say so. Field classification cut over from shadow mode days ago. That's new. We won't call it battle-tested. | Founded 2017, roughly $414M raised through a 2021 Series D. British Airways, Citi, Lockheed Martin and Optum sit on the logo wall. A Dell alliance, they say, passed $100M in annual recurring revenue. | ◇ |
| Pricing | Public model, scoped instant quote, no sales wall, no per-query meter. | Public and clear: free tier, then $0.50, $0.75 and $1.00 per credit. AIDA sits at the Enterprise tier, with its tokens billed separately. Credit maths at agent volumes is on you. | ◈ |
◆ DataShield leads◇ Starburst leads◈ comparable
Starburst claims are drawn from starburst.io and the Starburst build blog, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a query engine
The value is already a token
Access control decides who sees a column. It does not change what the column holds. We tokenize at ingest. An agent joins on TOK_9f2c... and the SSN stays in the vault. Reading it back is a separate, special, logged step. See the data plane.
Authority that can change mid-flight
An analyst quits on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield, the next checked tool call gets re-checked against current access. It fails closed. A session that takes on a user's access keeps going until something expires. How Auth does it.
Proof that survives an audit
An audit log you can edit proves nothing. Ours is a hash chain with signed checkpoints. The verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Where Starburst is genuinely stronger
Let us be plain about the gap. Starburst has built distributed SQL since 2017. They claim 84% of Trino commits in 2024. They run at a scale we have no business claiming. Say your data sits in eight systems and the answer needs all eight. Nothing in our stack helps there. Starburst does it in one query. Their 2026 run has been fast: a hosted MCP server in April, AIDA in May, Skills in June, Guardrails in July. A Dell deal, they say, passed $100M in yearly revenue that same month. The MCP write-up reads like grown-ups are involved. View-only checks at parse time. No open sign-up. Agents pinned to the logged-in user's own reach. We would have shipped it the same way.
Here is the push-back. Everything above is about reach: which tables, which rows, which columns. Once the query is allowed, the raw value goes to the model. The log that records it is an ordinary log. The agent keeps the user's full access for the rest of the session. In September their own guest post argued agents should sit behind a query layer. It listed the perks as fast joins, discovery and caching. All true, all about speed. Gartner expects most bad agent actions through 2028 to be internal policy breaks, not attacks. That is the case where a fast join is no comfort at all. Classification, tokenization and proof live at a different layer. They sit on top of a federated engine just fine.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on each call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints get signed and chained. Checking tells deletion apart from truncation, and from tampering. Run it against a sample chain at /verify. Starburst: the Galaxy audit log records each MCP step, with source tags and trace tokens. That's good logging. We found no public tamper-proof method over it. Ask them how you would spot an edited row.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call. A pulled grant lands on the very next call. Starburst's hosted MCP pins the agent to the logged-in user's access. In theory, pulling that user's access pulls the agent's too. Ask how fast a live session notices, and what the token lifetime is. That number is the size of your window.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key docs and issues an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments, not names. The proof still checks out once the subject is gone. Starburst queries data in place and does not own it. Erasure stays with the source systems. That is a fair setup, not a dodge. It just means nobody hands you the proof it happened.
Is DataShield a Starburst alternative for federated query?
No. If the job is "join across Snowflake, Iceberg and Postgres without copying", buy Starburst. We ingest and govern the datasets agents read. Our catalog covers PostgreSQL today, not your whole estate. Most buyers who talk to us about Starburst run both. The engine answers the question. We decide what the agent may see, and we keep the record.
AIDA has Guardrails. Isn't that the same thing?
It is a different layer. Their own July 2026 post says as much: Guardrails is a behavioural layer above the built-in controls. Four toggles: defend the agent against instruction extraction and injection hidden in data, hold the data-product boundary, cap prompt length, refuse listed topics. Useful, and we do none of it. What it does not do is change the values the model reads. It also leaves no record an examiner can check. Ask for both.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow, so a small vendor isn't a single point of failure. Details on the security page.
- Starburst's hero positioning: "Stop moving data. Start using it." with "100,000+ ETL pipelines eliminated" and "2.5x faster than Trino". - starburst.io, 13 Sep 2026
- Galaxy's hosted MCP server: OAuth 2.1 support, agents "only allowed to perform operations of the logged-in user", and any statement that modifies data "is rejected at parse time, before it ever reaches a Trino cluster". - Starburst blog, 9 Apr 2026
- AIDA Skills are authored by customers in the open agentskills.io format, are session-scoped, and execute their SQL under the invoking user's permissions. - Starburst blog, 12 Jun 2026
- Guardrails add four toggles (agent protection, data-product boundary, prompt limiting, topic filtering) as "a behavioral layer above the platform's existing structural protections". - Starburst blog, 7 Jul 2026
- Published Galaxy pricing: free tier, Pro $0.50 per credit, Enterprise $0.75 per credit with ABAC, SCIM, PrivateLink and AIDA (tokens billed separately), Critical $1.00 per credit. - starburst.io/pricing, 13 Sep 2026
- Starburst argues agents should query through a virtualization layer: "Data virtualization systems are able to perform joins of external datasets far more efficiently (and at lower cost) than modern agents." - Starburst blog, 11 Sep 2026
Other head-to-heads
DataShield vs Dremio
Query acceleration on the lake, versus access at the tool call.
PlatformDataShield vs Databricks
One platform for everything, and the evidence layer it doesn't ship.
WarehouseDataShield vs Snowflake
Governance inside the warehouse, versus proof that travels.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask what your query engine still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →