Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Vespa: the retrieval is fast, but who says this agent may read that corpus?

Vespa is the real thing. It came out of Yahoo. It spun out as its own firm in October 2023. It runs the search behind Perplexity, Spotify, Thomson Reuters and DuckDuckGo. Their pitch: a distributed serving engine that unifies search, ranking and model inference. Billions of changing items, thousands of queries a second, under 100 milliseconds. If you're building a public answer engine, buy Vespa and stop reading comparison pages.

We are not a serving engine, and we won't pretend otherwise. DataShield governs the data an agent reads. Data gets tokenized at ingest. Agents query it as tokens, over MCP. Reversing a token is a guarded, logged step. Our RAG runs on pgvector, with local embeddings. Nothing leaves your machines to be vectorized. Each governed tool call gets checked against the agent's access, before dispatch. Each choice gets sealed into a hash chain you can check yourself. Below is the honest split, including the rows Vespa wins outright.

Get free Demo Center access Get an instant quote
DataShield vs Vespa at a glanceEight questions regulated buyers ask us. Scored from each vendor's public material. DataShield vs Vespa at a glance Eight questions regulated buyers ask us. Scored from each vendor's public material. DataShield Vespa Tamper-evident audit chain you can verify Authority re-checked on every tool call PII and PHI classified before indexing Embeddings computed locally, no egress Hybrid retrieval and learned ranking Proven scale and latency in production Deployment choice and data residency Pricing shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The corpus has PHI, claims files or HR records in it. Someone has to say which agent may read which corpus. We check that on each governed tool call, not at index time. How Auth does it.
  • You need to pull an agent's access mid-job, and have the very next call fail. Not the next token refresh.
  • A reviewer will ask you to prove the search log was not edited. Our chain answers with math. Run the verifier.
  • Embeddings must not leave your machines. We run nomic-embed-text locally. No text ships to a vendor to be vectorized.

Pick Vespa when

  • Scale is the problem. Billions of items, thousands of queries a second, under 100 milliseconds. We are not in that conversation. We're not going to bluff about it.
  • You need learned ranking in the serving path: multi-phase ranking, tensors, ColBERT and ColPali style late interaction, model inference at query time.
  • You want an Apache 2.0 core you can fork, plus a managed cloud, if you change your mind later. That's a genuinely good deal.
  • Your reference class is public search and recommendation. The hard part there is relevance, not who is allowed to see the document.

Bottom line: Vespa serves the search. DataShield decides what an agent may see, and keeps proof of the choice. Running both is a normal answer. Vespa for the big public index. Us for the corpora with regulated content in them.

Feature by feature

Vendor cells describe what Vespa's public site and blog say, as of the date above. If we got something wrong, email support@myorg.ai. We'll fix it, and credit you.

What mattersDataShieldVespaEdge
Retrieval scale and latencypgvector with 768-dimension local embeddings. Hybrid keyword plus vector search. Sized for governed datasets and document corpora, not for a web-scale index. We publish no RAG accuracy number. We have no benchmark to point at.The core of the product, and the best part of it. Their site claims billions of changing items, thousands of queries a second, latency under 100 milliseconds. Perplexity and Spotify are references.◇
Ranking and relevanceHybrid search with a tsvector keyword leg and a vector leg. No learned ranking, no tensor framework, no query-time model inference.Multi-phase ranking, tensor expressions, in-process ML inference, ColBERT and ColPali embedders shipped in the engine. Years of hard-won relevance work.◇
Data handling before the modelFields get classified against 129 built-in PII, PHI, financial and secret classes. It uses regex, checksum checks, column-name lexicons and anti-pattern suppressors. Data gets tokenized at ingest. Agents query it as tokens, over MCP. Reversing a token is a guarded, logged step.A serving engine. Classification and redaction of indexed content are your job upstream. We found nothing about PII or PHI handling in their public docs.◆
Embeddingsnomic-embed-text runs locally, 768 dimensions. No text goes to a third party to be embedded. Chunk views apply read-time masking. The keyword index gets rebuilt from the masked text. So search can't be used to probe for a hidden value.Embedders run inside Vespa too. That's a point in their favour. They support outside models too, where you want them. Content masking is not part of the story.◆
Prompt egressWe do not proxy your LLM traffic. We do gate each value that leaves a governed dataset for a prompt. A PHI dataset refuses an endpoint without a BAA. Columns marked PII with no set treatment get redacted, not passed through.Not in scope. Vespa returns what you index and rank. What your app then puts in a prompt is up to your app.◆
Agent authorizationEach governed tool call passes four checks before dispatch. A scope ceiling. A consented-tool allowlist. An access tier. A mid-session pull-back check. The call fails closed.Vespa Cloud has mutual TLS and role-based access control at the app level. Their July 2026 essay on agent search argues agents deserve expert-grade search. It never mentions who is allowed to run it.◆
Audit evidenceSHA-256 hash chain. Ed25519-signed checkpoints, chained too. Verification returns clean, attested damage, or tampered, and names the failure. Try the verifier.Logs and a metrics dashboard. These are operational, not evidential. We found no cryptographic tamper evidence in their docs.◆
Break-glassScoped, time-boxed emergency access for agents. It auto-revokes. It can't be quietly removed from the log.Not described in their public docs.◆
GDPR erasureCrypto-shred of per-subject key material, plus ISO 27560 consent receipts. The audit chain still verifies afterward.Delete the doc and reindex. That works for the index. It says nothing about derived copies, or about the log.◆
MCP and agentsMore than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings. It meters each call, with the agent attributed.A public Vespa MCP server exists as of 13 September 2026, built by interns over the summer. Control plane auth is Auth0. Data plane access uses pre-generated tokens, single-tenant test only. The team says the server is under security review before any release.◆
DeploymentSelf-hosted, in your own cloud or data center. Or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. Ed25519 audit-signing keys stay on your instance, in a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth, not a shipped integration. HMAC tokenization keys sit in your environment today, not in a KMS. We'd rather say that now than let you find out later.Apache 2.0 core you can run anywhere, plus Vespa Cloud. Cloud Enclave, launched January 2024, runs managed Vespa inside an AWS account or GCP project you control. That's a strong answer on residency.◈
Maturity signalsLive and running (Guardian and Lighthouse since April 2026). Field classification cut over from shadow mode very recently. So treat it as new, not battle-worn. SOC 2 is planned, not attested, and we say so.Roots in Yahoo search from the early 2000s. Open source since 2017. Independent firm since October 2023. GigaOm Sonar Leader for vector databases, in February 2024. Reference customers most vendors would trade a round of funding for.◇
PricingPublished model and a scoped instant quote. Self-hosting means you pay for your own hardware.The open-source core is free, which is hard to beat. Vespa Cloud is consumption-based. Their pricing page posts a free trial and a contact form, not a rate card.◈

◆ DataShield leads◇ Vespa leads◈ comparable

Vespa claims come from vespa.ai and the Vespa blog, last checked 13 September 2026. We link the sources below, rather than work from memory.

Three things you get here that you won't get from a search engine

A corpus an agent has to ask permission to read

An index is a flat thing. It answers whoever queries it. We put a tool token with a scope ceiling in front of the corpus. On each call, we re-check the agent's access. We fail closed when the answer is no. Corpus promote and demote, between personal and org-visible, are audited events, not config edits. How Auth does it.

Proof that survives an audit

A retrieval log that can be silently edited proves nothing. Ours is a hash chain with signed checkpoints. The checker names what broke: tampering, insertion, deletion, or truncation. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Sensitive fields handled before they are indexed

129 classes cover PII, PHI, financial data and secrets. This includes all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. The method is regex plus checksums plus column-name proof. So a verdict is reproducible from a config digest. No model, no drift. See the catalog.

Where Vespa is genuinely stronger

Let me be blunt about the gap. Vespa has been serving search since the early 2000s, inside Yahoo. It's been open source since 2017. It became its own firm in October 2023. Yahoo stayed on, as an owner and a customer. GigaOm called it a Leader in vector databases, in February 2024. Perplexity runs on it. That's a production record no RAG-era startup can buy. We can't either. The engineering is deep, in ways that matter. Multi-phase ranking. Tensors. ColBERT and ColPali late interaction. Streaming search they claim is 20x cheaper than indexing. Autoscaling with cost boundaries. On pure search quality and throughput, they will beat us. We'd tell a prospect so on the call.

Here's the push-back. Read Jon Bratseth's July 2026 essay. It argues your agent should search like a 2010 quant. It's a good essay. It's also a perfect X-ray of the blind spot. Thousands of words about giving agents richer search. Not one about which agent is allowed to run the query. Or what happens when that person's access is pulled halfway through a job. Or what you hand a reviewer afterward. Their own MCP server, published this month, makes the same shape visible. The control plane uses Auth0. The data plane runs on pre-generated tokens, in single-tenant testing, with a security review pending. They're being honest about that. It tells you where search engines put their effort. Authorization and evidence are a different discipline. That's the one we ship.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained. The check tells deletion apart from truncation and from tampering. Try it on a sample chain at /verify. Vespa: they ship logs and a metrics dashboard for operating a cluster. We found no tamper-evidence proof in their public docs. Ask them what proof survives a root-level edit.

What happens to a revoked agent mid-session?

DataShield re-checks access on each governed tool call. So a pull-back lands on the very next call, and the context drops to anonymous. Vespa Cloud offers mutual TLS and role-based access control on the app. We could not find a per-query access re-check or a mid-session pull-back path. Ask how long a revoked client keeps querying your index.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed. So the proof still verifies once the subject is gone. With a search engine, you delete the doc and reindex. Ask what happens to derived copies, to the embeddings, and to the query log.

Is DataShield a vector database? Do we drop Vespa?

No, and probably not. Our RAG is real and GA: pgvector, local embeddings, hybrid keyword and vector search. It ingests from files, URLs and S3-compatible storage, with PDF, DOCX and EML extraction. It's sized for governed corpora, not for billions of items at sub-100ms. If your problem is web-scale relevance, Vespa wins. Run us where the content is regulated, and the question is who may read it.

We're building a RAG app on regulated data. What does Vespa leave to us?

Finding the PII in the documents before they get indexed. Deciding which agent may query which corpus. Stopping a sensitive value from reaching a prompt. Keeping proof of both. Those are all your problem with a serving engine. Fair enough, since that's not what a serving engine sells. It's what we sell. Ask Vespa the same question, and see whether the answer matches.

Does DataShield have SOC 2?

Not yet, SOC 2 is planned, not attested, and we will not imply otherwise. Auth is live, with a public threat model and a checker anyone can run. Guardian and Lighthouse have been live since April 2026. Design-partner terms include source escrow. A small vendor is not a single point of failure. Details on the security page. Vespa posts no certification list on the pages we fetched either. So ask both of us.

Other head-to-heads

Vector DB

DataShield vs Pinecone

Managed vector search, and the governance it leaves to you.

 Search

DataShield vs Elastic

The incumbent search stack, versus governed corpora for agents.

 Vector DB

DataShield vs Weaviate

Open-source vector search, and who is allowed to query it.

 All

Every comparison

One honest scorecard per vendor.

See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-job. Then decide what your search engine still owes you. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →