Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Unstructured: who guards the PII your parser just extracted?

Unstructured does one hard thing well. Point it at a scanned fax. Or a 400-page loan file. Or a PPTX somebody built in 2011. It hands back clean typed text, tables and chunks. Their homepage says it plainly: "We structure your unstructured data." 65+ file types. 40+ connectors. A public price of $0.015 a page, after the first 10,000 free ones. We won't argue with any of that, and couldn't have built it ourselves.

We are the layer after. DataShield is a checked data plane. The text your parser made gets tagged. Against 129 PII, PHI, financial and secret classes. Datasets get tokenized at ingest. Agents query tokenized data over MCP. Turning a token back into real data is a locked, logged step. Every checked tool call gets re-checked against the agent's live access. The result gets sealed into a hash chain. You can check it yourself. Below is the honest split. It includes the rows Unstructured wins outright.

Get free Demo Center access Get an instant quote
DataShield vs Unstructured at a glanceEight questions regulated buyers ask us. Scored from each vendor's public material. DataShield vs Unstructured at a glance Eight questions regulated buyers ask us. Scored from each vendor's public material. DataShield Unstructured Document parsing across 65+ file types Prebuilt source and destination connectors PII and PHI classification of extracted text Tokenization before the model sees it Authority re-checked on every tool call Tamper-evident audit chain you can verify FedRAMP High and SOC 2 Type II Published self-serve pricing shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The text coming out of the parser is full of PHI. Somebody has to decide what an agent may read. We tag against 129 field classes. We tokenize at ingest. We gate every value that leaves a checked dataset for a prompt. How the data plane works.
  • An examiner will ask you to prove the agent log was not edited, sooner or later. Our chain answers with math. Run the verifier.
  • You need to pull an agent's access mid-session. The very next tool call should fail. Not the next token refresh.
  • Everything has to run on your own gear. That includes the embedding model. We embed locally. No text leaves for a third-party embedding API.

Pick Unstructured when

  • Your problem is the documents themselves. Scans, tables, mixed layouts. 65+ file types. That's their whole company. They publish benchmarks defending it.
  • You want connectors, not code. Over 40 sources and destinations. Plus webhooks, to wire output into whatever comes next.
  • You are buying for a government or defence programme. FedRAMP High. CMMC 2.0. A NAVSEA award with Elastic, February 2026. We have no FedRAMP path today.
  • You want to start this afternoon with a credit card and 10,000 free pages.

Bottom line: Unstructured turns your files into text. It doesn't tell you which text is a patient ID. It doesn't decide who may read it. Most teams we talk to should run both. Unstructured goes in front of us.

Feature by feature

Competitor cells describe what Unstructured's public site, docs and blog say. We use the date above. If we got something wrong, email support@myorg.ai. We'll fix it and credit you.

What mattersDataShieldUnstructuredEdge
Document parsingWe pull text from PDF, DOCX and EML. We store it as a versioned copy file. Three formats. No OCR, no table model, no layout model. It's enough to get a contract or discharge note into a corpus. It's not a parsing tool.The core product, and a good one. 65+ file types. OCR, table extraction, layout intelligence. Published accuracy benchmarks, defended against frontier models.◇
ConnectorsIngest from uploaded files, SSRF-guarded URLs, and S3-compatible storage. It streams multi-gigabyte objects. Plus a live PostgreSQL catalog connection. That's the list.Over 40 prebuilt source and destination connectors. Plus webhooks, to push pipeline output downstream.◇
PII and PHI in the extracted text129 built-in field classes. They cover PII, PHI, money data and secrets. That includes all 18 HIPAA Safe Harbor identifiers and eight non-US ID formats. Regex plus checksum checks: Luhn, NPI, Verhoeff, ABA, IBAN, GTIN. Plus name lists and anti-pattern filters. Fixed rules, so a result is repeatable from a config digest. No model. No drift.We found no PII detection, tagging, redaction or tokenization feature anywhere. Not on the home page, price page, sales page, Extract post, Transform MCP post, or the open-source README. Their badges describe their own platform. Not a feature applied to your files.◆
Tokenization and data handlingFixed, join-safe, vault-reversible tokens, applied at ingest. Plus quasi-identifier shrinking: dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get part masked. Each column gets a measured shrink score. Every token vault lookup is locked to admins, tied to your tenant, and logged. The log write must succeed, or the lookup is refused.Not their job, and they don't claim it. Text goes in. Structured text comes out. The sensitive values stay intact.◆
Prompt pathWe don't proxy your LLM traffic. We do gate every value that leaves a checked dataset for a prompt. A tagged column with no set rule gets redacted, not passed through. A PHI dataset refuses any AI endpoint that isn't marked BAA or ZDR approved. One honest catch: RAG file text is served raw, apart from a standing filter for touchy patterns. Don't load files whose body text must stay masked.No prompt gate. The pipeline output is handed to whatever you point it at.◆
Embeddingspgvector with local nomic-embed-text embeddings, 768 dimensions, plus hybrid keyword and vector retrieval. Nothing leaves your box to be embedded.Embedding is one pipeline step, with partner add-ons. Where the text gets embedded depends on the model you pick. Worth asking.◆
MCP and agentsMore than 200 MCP tools, across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with a scope ceiling. It meters every call and ties it to the agent.Transform MCP, shipped July 2026: "a Model Context Protocol server that gives AI agents document processing as a callable tool." Real and shipping. We found no per-call authorization, scope ceiling or audit artifact described for it.◆
Agent authorizationEvery checked tool call passes a scope ceiling. Plus a consented-tool allowlist, and an access tier. Plus a mid-session re-check, before dispatch. It fails closed. Delegation is RFC 8693 token exchange, with a locked scope ceiling.Company accounts, role-based access control, and fine-grained rules, on the platform itself. That governs who logs into the console. Not what an agent may do with the extracted text.◆
Break-glassScoped, time-boxed emergency access for agents. Admin and IP-allowlist locked. Step-up required. It can't be quietly wiped from the log.Not described in their public material.◆
Audit evidenceA SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are themselves chained. Verification returns a three-valued verdict. It names the failure: tampering, insertion, deletion, or truncation. Try the verifier.The lakehouse post promises "one auditable path from raw document to production agent" when you write into Unity Catalog. The audit belongs to Databricks in that story. Not to Unstructured.◆
GDPR erasureCrypto-shred of per-subject key material. Plus ISO 27560 consent slips. Actor IDs in the chain are HMAC-locked. The log still checks out after the subject is gone.GDPR compliance is claimed as a platform posture. We found no described erasure mechanism for content already pushed downstream.◆
DeploymentSelf-hosted, in your own cloud or data center. Or a dedicated single-tenant server we run for you. Docker images for Auth, Ontology, Corpus and Lighthouse. A signed deploy file, checked by Guardian. Ed25519 log-signing keys stay on your box, in a key folder you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth, not a shipped link. HMAC tokenization keys sit in your setup, or come from your machine key today. Not in a KMS.Managed SaaS, dedicated instance, VPC or bare metal on the Business tier. The open-source library runs anywhere you can run Python, under Apache 2.0.◈
Compliance and public sectorSOC 2 not yet certified, and we say so. No FedRAMP path. Our rules cite design sources, tied to the mechanism. HIPAA §164.312(b), §164.514(b)(1) and (b)(2), GDPR Art. 17, ISO 27560, RFC 8785.FedRAMP High certified, SOC 2 Type II qualified, HIPAA and GDPR claimed, CMMC 2.0. NAVSEA contract with Elastic, February 2026.◇
Maturity signalsAuth, Guardian and Lighthouse are live in production. Guardian and Lighthouse since April 2026. Field tagging moved from shadow mode to live very recently. Call it new, not battle-tested. Small team. Source escrow on design-partner terms.Founded 2022, 15.4k stars on the open-source library, Fortune 500 logos including IBM, JPMorgan Chase, Bank of America and Humana.◇
PricingPublished model, scoped instant quote, no sales wall.Published too: 10,000 free pages, then $0.015 a page. The Business tier with VPC or bare metal is quote-only.◈

◆ DataShield leads◇ Unstructured leads◈ comparable

Unstructured claims are drawn from unstructured.io, their price and sales pages, their blog, and their GitHub repo. Last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from a document ETL tool

The parser's output, classified

A discharge note parsed into perfect JSON is still a discharge note. We tag every field against 129 classes. That includes all 18 HIPAA Safe Harbor identifiers. We use regex, checksums, and name-list evidence, not a model. The result is repeatable from a config digest. That matters the day someone asks why a column got tagged that way. See the classifier.

Authority that can change mid-flight

An analyst quits on a Friday. Their agent is 20 minutes into a 40-minute job over your contract corpus. The next checked tool call gets re-checked against live access. It fails closed. A pipeline tool has no view on this. It was never asked. How Auth does it.

Proof that survives an audit

A log that can be quietly edited proves nothing. Ours is a hash chain with signed checkpoints. The verifier tells you what broke, not just that something did. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Where Unstructured is genuinely stronger

Parsing is harder than people think. They have the receipts. Their November 2025 post, and their April 2026 piece, argue that frontier models still lose to a purpose-built parser. This is the work of a team that has stared at broken PDFs for four years. 65+ file types. OCR, table pulls, layout handling. None of that is ours, and we don't pretend otherwise. Our extraction covers PDF, DOCX and EML. That's enough to fill a corpus. It's nothing like a parsing tool. Add 40-plus connectors, webhooks, an Apache 2.0 library with 15.4k stars, FedRAMP High, and a NAVSEA award. That's a firm with a real moat in a real field. Their price is public and cheap to try. We respect that. We publish ours too.

Here's the push-back, and it's a narrow one. Read their June 2026 lakehouse post with care. The pitch: your files "inherit the governance your team already built" once they land in Unity Catalog. That's an honest answer. It's also an admission. The rules live somewhere else. Now look at Transform MCP, from July 2026. An agent calls the parser directly. The extracted text goes straight back into the model's context. In that path there's no lakehouse. No inherited rules. Nothing that caught the medical record numbers on page four. That's the seam we sell into. Run their parser. Land the output in a checked dataset. Let the agent query it under a tool token, instead of a cURL.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record ties to the one before it. Checkpoints are Ed25519-signed and chained. Checking tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Unstructured: their material points at the target platform for logs, such as Unity Catalog. Ask who holds the log when an agent calls Transform MCP directly, with no lakehouse involved.

What happens to a revoked agent mid-session?

DataShield re-checks access on every checked tool call. Revocation lands on the next call. That call fails closed. Unstructured's sales page describes role-based access control and fine-grained rules for the platform. We found no per-call check or revocation step for their MCP server in public docs. Ask how long a revoked agent keeps parsing.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material. It issues an ISO 27560 consent slip. Actor IDs in the chain are HMAC-locked. The log still checks out once the subject is gone. Unstructured claims GDPR compliance as a platform trait. What happens to a subject's data already sent to three targets is your problem, not theirs. Ask them where erasure lands.

Where does PII get redacted or tokenized in an ETL for LLMs pipeline?

This is the question. In our path, tagging runs on the dataset. Tokens get applied at ingest. The prompt-exit gate redacts any tagged column with no set rule, rather than letting it through. A PHI dataset refuses any AI endpoint not marked BAA or ZDR approved. In Unstructured's public material we found no PII detection feature at all. None for redaction. None for tokenization. Checked on any page, 13 September 2026. Ask them to show the feature, not the badge.

Is DataShield an Unstructured alternative, or do we run both?

Mostly both. If your pain is scanned PDFs and mixed layouts, buy their parser. Ours handles PDF, DOCX and EML, and stops there. Run us where the output lands: tagged, tokenized, queried by agents under tool tokens. With a chain you can check. One case is different: a team already inside PostgreSQL, with plain text-file documents. They wanted the rules more than the OCR. There, we replace them.

Does DataShield have SOC 2 or FedRAMP?

Not yet. We won't imply otherwise. Unstructured has FedRAMP High and SOC 2 Type II status. On that row, they beat us cleanly. What we offer instead: a published threat model. A verifier anyone can run. Source escrow on design-partner terms. So a small vendor isn't a single point of failure. Details on the security page.

Other head-to-heads

RAG

DataShield vs LlamaIndex

A framework for building RAG, and the governance it leaves to you.

 RAG

DataShield vs Ragie

Managed RAG as a service, versus RAG you can self-host and prove.

 RAG

DataShield vs Contextual AI

Grounded answers for the enterprise, and who authorized the read.

 All

Every comparison

One honest scorecard per vendor.

See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your parsing pipeline still owes your compliance team. Demo Center access is free, with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →