Head-to-head · updated 13 September 2026
DataShield vs Weaviate: your vector database is fine, but can you prove what the agent read?
Weaviate is a good vector database. Not "good for an open-source project". Just good. Their homepage hero reads "Design, build and ship complete AI experiences". The sub-line: "Vector search, RAG, and memory - all in one open-source platform." They have earned the right to say it. 20M+ downloads. Hybrid search. One customer runs 50,000 tenants in a single cluster. A steady run of index work through 2026, too. We are not going to out-engineer their index. We are not going to pretend we tried.
Here is the part their docs skip. Weaviate stores and serves whatever you embed. It has no view on that. Did the chunk hold a member ID? DataShield classifies fields first, against 129 PII, PHI, financial and secret classes. We tokenize datasets at ingest. Agents then query tokenized data over MCP. Turning a token back into real data: a privileged, audited step. Embeddings run locally. The text never leaves your infrastructure. We re-check every governed tool call against the agent's authority. Before it runs. We then seal the decision into a hash chain. You can verify it yourself. Most teams should run both. This page says which job lands where.
The short version
Pick DataShield when
- The corpus holds health, financial or personal data. Someone has to say in writing what got embedded. We classify the fields first. Then we build chunks and vectors from the masked view. How the catalog works.
- An examiner will ask you to prove the retrieval log was not edited later. Our chain answers with maths. Not a policy PDF. Run the verifier.
- You need to pull an agent's authority mid-session. The very next tool call should fail. Not the next token refresh.
- Embeddings must be computed in your own environment. Ours run on a local model. No chunk text is sent to a third party.
Pick Weaviate when
- Retrieval quality and scale are the whole job. Nine billion vectors in one production deployment is their customer's number, not ours. We have nothing like it.
- You want a real open-source core under a BSD-3 licence. A large community backs it, plus 20M+ downloads. That is a genuine hedge against vendor risk.
- You need SOC 2 and HIPAA today from the vendor running your cluster. They have both. We do not.
- The agent memory layer matters. Engram went GA in June 2026. It is a product line we do not have at all.
Bottom line: Weaviate is where your vectors should live if scale is the problem. DataShield is where the sensitive corpus should live if proof is the problem. Only have budget for one, and the data is regulated? Start with the layer that answers the auditor.
Feature by feature
Competitor cells describe what Weaviate's public docs say. Their blog and pricing page, too. As of the date above. Did we get something wrong? Email support@myorg.ai. We will fix it. And credit you.
| What matters | DataShield | Weaviate | Edge |
|---|---|---|---|
| Vector search and indexing | pgvector with 768-dimension vectors per corpus, plus a keyword leg over tsvector for hybrid retrieval. It works. It is not a specialist engine. We have published no retrieval benchmark. Do not take a number from us. | The core product, with years of work behind it. HFresh disk-based index went GA in June 2026. BlockMax WAND, rotational quantization down to 4 bits in preview, MMR diversity selection, replica movement, too. This is their craft. | ◇ |
| What gets embedded | We classify fields against 129 classes before ingest. That covers all 18 HIPAA Safe Harbor identifiers. Eight national ID formats. 11 secret types. Some datasets have masked columns. There, chunk text and vectors come from the masked view. We never embed the raw value. We index free-text documents as written. Apart from one standing pattern filter. Our own tool docs say so. | It stores what you send it. We found no classifier. No sensitive-field detection. No masking layer in their docs. That is a fair design choice for a database. It just means the scrubbing is your code. | ◆ |
| Embedding model and egress | Local nomic-embed-text, 768 dimensions, running in your environment. We never send chunk text to an embedding vendor. | Self-hosted Weaviate can point at a local model. Weaviate Cloud also sells an embedding service. Most of the documented paths call a third-party model provider, though. Both are available. Check which one your team actually wired up. | ◈ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints, themselves chained. Verification returns one of three verdicts. It names the failure: tampering, insertion, deletion or truncation. See the verifier. | Six Prometheus metrics under weaviate_mcp_*, for tool traffic, latency, auth failures and the write-access flag. Useful for operations. We found no per-retrieval audit record. And no tamper evidence over one. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling. And a consented-tool allowlist. It carries an authority tier, too. And a mid-session revocation re-check before dispatch. It fails closed. Cedar covers admin, config and token decisions. Not the dispatch path. We will not claim otherwise. | Real RBAC on the MCP server. read_mcp, create_mcp and update_mcp permissions, a predefined viewer role. Plus MCP_SERVER_ENABLED and MCP_SERVER_WRITE_ACCESS_ENABLED deployment flags. Better than a global toggle. It is still a static grant, checked at execution. Not authority that can change while a job runs. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin and step-up gated. IP-allowlisted, and fully logged. It expires on its own. | Not described in their public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. We HMAC-commit actor identities in the chain. The proof still verifies. Even after we lose the subject. | Object deletion and TTL support. An embedding derived from deleted text is a harder question. Their docs do not take it on. Ask them what happens to the vector. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens, applied at ingest. Plus quasi-identifier generalization. Dates go to year, decade or age band. ZIPs go to 3 or 4 digits. Phones, SSNs and emails get partial masking. Each column gets a measured cardinality-reduction score. | Not part of the product. They do not claim it. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings. It meters every call, with the agent attributed. Ontology's MCP surface authenticates by API key, with per-tool tier gating. | Built-in MCP server, GA in v1.38, June 2026, served on the REST port. Four tools: hybrid query, collection config, tenant list and object upsert. Plus the agents line. Query Agent GA since September 2025. Engram GA since June 2026. | ◈ |
| Agent memory and orchestration | None. We govern datasets and retrieval. Memory for your agents is your framework's problem. | Engram, a managed memory and context service. GA on 3 June 2026. Plus Transformation and Personalization agents. A real product line. | ◇ |
| Deployment | Self-hosted in your own cloud or data center. Or on a private single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. A signed deploy manifest, checked by Guardian. Ed25519 audit-signing keys stay on your instance. They live in a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS or HSM custody is a built seam in Auth. Not a shipped integration. HMAC tokenization keys sit in your environment today. Not in a KMS. | Open source under BSD-3, and genuinely self-hostable on Docker or Kubernetes. That is the strongest self-host story among the pure-play vector vendors. Also managed cloud, in about 40 regions on AWS, GCP and Azure. Dedicated tenants, and bring your own cloud, too. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production. Guardian and Lighthouse since April 2026. RAG is GA. SOC 2 not yet certified, and we say so. | Founded 2019, Amsterdam. $50M Series C in October 2025. SOC 2 and HIPAA claimed on their security page. An enterprise logo wall too, including Cisco, Intuit, Thales and Booking. | ◇ |
| Pricing | Published model and a scoped instant quote. No sales wall. | Published and clear. Free tier at 100k objects. Flex from $45 a month, pay as you go. Premium from $400 a month, prepaid. Credit to them. Most of this market hides it. | ◈ |
◆ DataShield leads◇ Weaviate leads◈ comparable
Weaviate claims come from weaviate.io and docs.weaviate.io. Plus their own blog. Last checked 13 September 2026. Links sit at the bottom of this page.
Three things you get here that you won't get from a vector database
The corpus is classified before it is indexed
A vector index is happy to embed a member ID. It has no opinion. We label columns against 129 classes first. Then we build chunks and vectors from the masked view. The method: regex, and checksums such as Luhn and IBAN. Column-name lexicons, and anti-pattern suppressors. No model. So the same input gives the same verdict next year. See the catalog.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute retrieval job. With DataShield, we re-check the next governed tool call against current authority. It fails closed. An RBAC grant made at token time does not do that. How Auth does it.
Proof that survives an audit
"Trust me, this is the retrieval log" is not proof. Ours is a hash chain with signed checkpoints. The verifier says what broke. Not just that something did. That is the property reviewers care about. EU AI Act Article 12. HIPAA §164.312(b). Try it in your browser. No signup.
Where Weaviate is genuinely stronger
Almost everything about retrieval itself. They have been building this since 2019. It shows in the boring places. Disk-based indexes for memory-tight clusters. Quantization that keeps recall while shrinking vectors. Replica movement. Multi-tenancy at counts most teams will never reach. Their 2025 framing was "dependability before abstraction". Unfashionable thing to write. Right instinct, though. The open-source core is real. Not a teaser edition. You can walk away from the vendor and keep running. They also ship faster than we do. They got to SOC 2 and HIPAA before us. On the agent side, Query Agent has been GA since September 2025. Engram since June 2026. We have no answer to either.
The push-back is narrow. It is about the job next door. Their MCP server exposes four tools. It gates them with RBAC grants. That is a sensible design. But a permission is a grant, not a record. Nothing in their docs names the agent. Or the chunk it pulled at 02:14 on a Tuesday. Nor does it say if that agent still had the right to. Or shows if someone edited the log since. For an internal analytics app, that is fine. For a clinical or lending corpus, it is the whole conversation. Gartner expects most unauthorized agent transactions through 2028 to be policy violations. Not attacks. Those do not trip a security alert. They only show up in the record. And only if the record is worth reading.
Questions worth asking both of us
These are the questions we would want answered. If we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove a retrieval log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained. Verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Weaviate: their MCP server emits six Prometheus metrics. Those are counters. Not a record of what an agent read. A metrics store is not tamper evident. Ask them to show you a per-retrieval log. Then ask how you would detect an edit to it.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call. Revocation lands on the next call. Weaviate enforces RBAC grants at tool execution. That is real enforcement. But the grant is the thing it checked. We could not find mid-session revocation in their docs. Ask how long a compromised agent keeps querying. After you pull its role.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. We HMAC-commit actor identities in the chain. The proof still verifies. Even once we lose the subject. Weaviate supports object deletion and TTL. The awkward part is the embedding. A vector made from a person's text counts as derived data. Deleting the object does not obviously settle it. Their docs do not address it. Ask.
Is DataShield a Weaviate alternative, or do we run both?
Mostly both. We would rather say that than sell you a worse index. Our RAG is GA and honest. pgvector, hybrid keyword and vector retrieval. Local embeddings. We ingest files, URLs and S3-compatible storage. PDF, DOCX and EML extraction, too. It is enough for a governed corpus. Policies, claims, or clinical notes. It is not enough for nine billion vectors. Run Weaviate for scale. Run us for the corpora where someone has to sign a form.
We're building a HIPAA RAG app. Why not just use Weaviate Cloud, which is HIPAA compliant?
You can, and for many teams that is the right call. HIPAA compliance of the host just says one thing. The vendor handles the cluster properly. It does not say the PHI needed to be in the chunk. Not at all. Our egress gate is the other half. We redact a PII or PHI column with no configured treatment. Not passed through. A PHI-classified dataset refuses an AI endpoint. Unless it's marked BAA or ZDR approved. It fails closed, and it says why. Minimum necessary is a §164.502(b) obligation on you. Not on your database vendor.
Does DataShield have SOC 2?
Not yet. We will not imply otherwise. Weaviate does, along with HIPAA. That is a straight win for them on any procurement checklist. What we offer instead: a public threat model. A verifier anyone can run without an account. Design-partner terms include source escrow, too. That way a small vendor is not a single point of failure. Details on the security page.
- Weaviate's positioning: "Design, build and ship complete AI experiences" and "Vector search, RAG, and memory - all in one open-source platform." - weaviate.io, 13 Sep 2026
- Weaviate Cloud pricing: free tier at 100,000 objects, Flex from $45/month pay as you go, Premium from $400/month prepaid with shared or dedicated deployment. - weaviate.io/pricing, 13 Sep 2026
- Weaviate's MCP server exposes four tools and gates them with read_mcp, create_mcp and update_mcp RBAC permissions, plus MCP_SERVER_ENABLED and MCP_SERVER_WRITE_ACCESS_ENABLED flags; observability is six Prometheus metrics. - docs.weaviate.io, 13 Sep 2026
- 2025 additions included cluster RBAC, OIDC group management, HIPAA compliance for Weaviate Cloud, and Query Agent reaching general availability, under the framing "dependability before abstraction". - Weaviate blog, 2025 year in review
- Weaviate claims SOC 2 and HIPAA compliance, end-to-end encryption, role-based access control, native multi-tenancy, and deployment in a dedicated tenant or your own VPC. - weaviate.io/security, 13 Sep 2026
- Weaviate 1.38, June 2026: the built-in MCP server and the HFresh disk-based vector index both reach general availability. - Weaviate blog, 25 Jun 2026
Other head-to-heads
DataShield vs Pinecone
Managed vector search at scale, versus governed retrieval you can prove.
Vector DBDataShield vs Qdrant
Rust-fast open-source search, and the evidence layer above it.
Vector DBDataShield vs Milvus and Zilliz
Billion-scale indexes, versus classification before embedding.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask what your vector database still owes your compliance team. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →