Head-to-head · updated 13 September 2026
DataShield vs Strac: a filter in the tool call, or an identity plane behind it?
Strac is the closest thing to a real rival we have. I'd rather say that up front than pretend otherwise. Their MCP gateway genuinely sits in the live tool-call path. It redacts PII, PHI, card data, secrets, and source code before the model sees them. They ship a Claude DLP product covering Claude Chat, Desktop, Code, Cowork, and MCP connectors. They have SOC 2, ISO 27001, HIPAA, PCI, and logos like UiPath. We have none of that, and no inline interceptor at all.
DataShield works the other way round. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Detokenization is a special, audited step. On top of that sits the part a filter can't do. We issue the agent's token. Its scope gets capped. We re-check its access on each checked tool call. We seal each decision into a hash chain you can verify without trusting us. Below is where that difference actually bites.
The short version
Pick DataShield when
- You want to be the issuer of agent identity, not an observer of it. Auth mints MCP tool tokens with scope ceilings and access tiers. It rotates JWKS. It keeps a services registry. How Auth does it.
- You need an agent's access pulled mid-session. The very next checked tool call should fail closed, not ride out to expiry.
- Someone will eventually ask you to prove the access log wasn't edited. Our chain answers with math. Tampering, insertion, deletion, and truncation get told apart by name. Run the verifier.
- The re-identification store has to live on your own setup, on your keys, with a documented way to crypto-shred a data subject out of it.
Pick Strac when
- You need redaction inside the live tool call, right now. Their gateway does that between agents and M365, Slack, GitHub, Snowflake, Salesforce and more. We don't sit inline. We won't claim we do.
- Your exposure is Claude surfaces specifically. Their Claude DLP product covers Chat, Desktop, Code, Cowork, and MCP connectors, with real-time detection, redaction, and blocking.
- You need whole-perimeter DLP: endpoint, browser, email, and 40-plus SaaS integrations. We have no endpoint or browser story at all.
- Procurement needs SOC 2, ISO 27001, HIPAA, PCI and named logos on day one. Strac has them. We don't. We say so on every page.
Bottom line: Strac picks what data passes through a tool call. DataShield decides whether the agent was allowed to make the call, and it keeps proof of the decision. If your board question is "did anything sensitive leak into a prompt," buy Strac. If it's "prove what the agent was allowed to do, and prove the log is intact," that's us.
Feature by feature
Rival cells describe what Strac's public site and blog say as of the date above. If we got something wrong, email support@myorg.ai. We'll fix it, credited.
| What matters | DataShield | Strac | Edge |
|---|---|---|---|
| MCP protection model | Datasets get tokenized at ingest. Agents query tokenized data over MCP. Detokenization is a special, audited step. Nothing sensitive sits in the queryable store to race at request time. A fail-closed gate sits between a checked dataset and any prompt. | Gateway intercepts each tool call between the agent and the MCP server, and redacts inline. Per-class fixes: redact in place, mask, tombstone, quarantine, or vault. | ◇ |
| Inline interception | We do not proxy your LLM traffic. We do gate each value that leaves a checked dataset for a prompt. A PII or PHI column with no set treatment gets redacted. A PHI dataset refuses any AI endpoint not marked BAA or ZDR approved. That is a gate on our own data path, not an inline product. | Yes, shipped, across M365, Google Workspace, Slack, GitHub, Snowflake, Salesforce, Atlassian, Stripe and more. | ◇ |
| Agent authorization | Each checked tool call passes a token scope ceiling and a declared access tier. It gets a revocation re-check before dispatch. Cedar handles admin, config, and token calls. | Admins can decommission MCP connections. We found no public per-call access check or access tiers. | ◆ |
| Agent identity | Auth issues the credentials: MCP tool tokens, RFC 9068 JWTs, JWKS rotation, an MCP services registry. We're the issuer, not a watcher. | OAuth-grant sight into AI vendors. Plus agentless discovery of shadow MCP servers in repos and dev setups. Useful, but a watcher's view only. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and lands in the chain, where it can't be quietly removed. | Not offered in their public docs, so far. | ◆ |
| Audit evidence | A SHA-256 row chain, with Ed25519-signed checkpoints, themselves chained. Checking it names the failure: tampering, insertion, deletion, or truncation. Try the verifier. | An audit ledger per call, described as mapping to SOC 2, HIPAA, PCI and ISO 42001. No crypto proof or public check method. | ◆ |
| Tokenization | Deterministic HMAC tokens, applied at ingest. Join-preserving across datasets, and vault-reversible. Plus quasi-identifier generalization: dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking too, with a measured cardinality-reduction score per column. Not format-preserving, and we don't claim it. | Tokenization is one fix option per payload, alongside mask, tombstone and quarantine, with token APIs and detokenize-on-approval. | ◆ |
| Re-identification store | Connection Vault and detokenization run self-hosted, or on your own setup. Your keys, your account. | Vault with RBAC re-identification, hosted in their cloud. Every caught original lands there. Worth asking who holds the keys, and where. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. Actor identities carry HMAC commitments, so the chain still verifies after a subject is erased. | GDPR and CCPA alignment stated. We found no public data-subject erasure workflow, and none for the re-identification vault. | ◆ |
| Deployment | Self-hosted, or dedicated single-tenant. Signed licenses and design-partner source escrow. | Cloud-native SaaS, agentless, a 15-minute setup claim, and a free trial too. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse run live in production (Guardian and Lighthouse since April 2026). No certs, no named clients. We won't say otherwise. | YC W22, roughly $4M seed, SOC 2, ISO 27001, HIPAA, PCI, and clients including UiPath, CDC, Inmar and thredUP. | ◇ |
| Pricing | Public model, scoped instant quote, no sales wall. | Sales-gated. No public figures found. | ◆ |
◆ DataShield leads◇ Strac leads◈ comparable
Strac claims are drawn from strac.io and its blog, last checked 13 September 2026. We link the sources below rather than paraphrase from memory.
Three things you get here that you won't get from a DLP gateway
We issue the agent's credentials
Strac can tell you which AI vendors hold OAuth grants. That's visibility into decisions someone else made. Auth mints the MCP tool token itself. It caps what it can ever reach with a scope ceiling. It pins a declared access tier to it. Discovery finds a shadow MCP server. Issuance decides whether it gets to authenticate at all. How Auth does it.
Revocation that catches a running job
An analyst leaves on a Friday. Their agent is thirty minutes into a job. With DataShield, the next checked tool call gets re-checked against current access. It fails closed. Decommissioning a connection in an admin console doesn't reach inside a session already running. See the architecture.
Proof the ledger wasn't edited
"Audit-ready" means a log exists. Ours is a hash chain with Ed25519-signed checkpoints, themselves chained. Deleting a checkpoint shows up too. The verifier tells you what went wrong. That's what EU AI Act Article 12 and HIPAA §164.312(b) reviewers are built to test for. Break one in your browser.
Where Strac is genuinely stronger
Their gateway is real, and it's shipped. It sits between the agent and the MCP server. It redacts inside the call, with fixes you can set per data class. Their detection reaches into PDFs, Word files and images, across endpoint, browser, email and forty-odd SaaS apps. Their Claude DLP product covers Claude Chat, Desktop, Code, Cowork and the MCP connectors by name. Add SOC 2, ISO 27001, HIPAA, PCI and clients like UiPath and thredUP. For a lot of security teams, that's a shorter buying path. We can't beat it this year. If you need free-form payloads scrubbed in flight, we can't do it. I'm not going to invent a story where we can.
The push-back is about what a filter is for. A filter decides what data passes. It doesn't decide what the agent was allowed to do. Gartner expects most agent actions that aren't allowed, through 2028, to be internal policy breaks, not attacks. A policy break by a well-behaved agent with too much scope shows up in no detection log at all. There's a thing that follows from the design, too. To redact PHI, the gateway had to read it. So a vault of originals lives in their cloud, and it grows every day. Ask where that store is. Who holds the keys? Ask how a data subject gets removed from it, with evidence.
Questions worth asking both of us
These are the five I'd put to a vendor sitting where we sit. Put them to us as well.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, and the check is yours to run, not ours to assert. Each record commits to its predecessor. Checkpoints carry an Ed25519 signature and chain to each other, so lifting one out shows up too. Checking tells deletion apart from truncation and from tampering. There's a sample chain at /verify. Strac: their MCP audit ledger is described as mapping to SOC 2, HIPAA, PCI and ISO 42001. We found no public proof or check method. Ask them to show one.
What happens to a revoked agent mid-session?
Access gets re-read at dispatch on each checked tool call. A pulled grant bites on the next call, and the context drops with it. Strac lets an admin decommission an MCP connection. We found no public per-call re-check on pulled access. That suggests a session already in flight keeps going. Get a number out of them: after the pull, how many more calls can that session make?
How does GDPR erasure interact with the audit trail, and with the re-identification vault?
We destroy the subject's key material. That makes their data unreadable. We hand back an ISO 27560 receipt. Actor identities in the chain are HMAC commitments, not names. Nothing has to be deleted for the erasure to be real. Strac states GDPR and CCPA alignment. We found no public erasure steps, though, and their vault builds up originals of everything intercepted. This is the question I'd press hardest on: erasure has to reach the vault too.
Strac intercepts tool calls inline and you don't. Isn't that a gap?
It's a real gap, and we won't dress it up. Our answer is to move the problem earlier. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Detokenization is a special, audited step. There's no raw value in the queryable surface to race at request time. The trade-off is honest. Say an agent pulls a free-form payload from a system we never ingested. A gateway catches it. We don't. Several buyers run both for that reason.
Where does the re-identification data actually live?
DataShield: your own setup. Self-hosted, or dedicated single-tenant, with your keys and a documented crypto-shred path. Strac is cloud-native SaaS. Intercepted payloads and the vault of originals sit and travel through their cloud. If your rule is that PHI never leaves your account, that's the difference that decides it. It doesn't matter who has the better detector.
Does DataShield have SOC 2?
No. Strac does, along with ISO 27001, HIPAA and PCI, and that row goes to them. What we offer instead is mechanisms you can check, not attestations you have to accept. Auth runs live with a public threat model and a verifier anyone can run. Guardian and Lighthouse have run in production since April 2026. Design-partner terms include source escrow. Security page.
- Strac's current hero: "AI-Native Data Security Platform For SaaS." Primary CTA is "Book a Demo." - strac.io, 13 Sep 2026
- Strac's MCP gateway "intercepts every tool call"; its audit ledger is described as mapping to SOC 2, HIPAA, PCI and ISO 42001. - strac.io/blog/mcp-gateway, 13 Sep 2026
- Per-class remediation includes redact in place, mask, tombstone, quarantine, or vault with RBAC re-identification. - strac.io/blog/ai-dlp, 13 Sep 2026
- Strac's Claude DLP covers Claude Chat, Desktop, Code, Cowork and MCP connectors with real-time detection, redaction and blocking. - strac.io/blog, 17 Apr 2026
- Strac: YC W22, roughly $4M seed raised in July 2022 from Y Combinator and FUSE. - Y Combinator company profile, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. - Gartner, 2026
Other head-to-heads
DataShield vs Skyflow
A privacy vault with an inline gateway, versus proof of what the agent did.
DirectDataShield vs Protecto
Detection rates are table stakes. What happens after detection is the fight.
DirectDataShield vs Noma Security
Full-lifecycle platform versus a verifiable evidence layer.
AllEvery comparison
Eleven vendors, one honest scorecard each.
See the mechanisms a filter can't run. Break a live audit chain. Revoke an agent mid-session. Then pick whether you need one product or two. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →