Head-to-head · updated 13 September 2026
DataShield vs AI gateways: which layer does the obligation land in?
An AI gateway is probably already in your stack, and it should be. Kong, LiteLLM, Portkey (now Prisma AIRS) and TrueFoundry do model routing, failover, rate limits, spend caps, inline redaction, and as of this year MCP registries too. We don't do any of that and we're not trying to.
The gateway governs the pipe. DataShield governs the data. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority, and each decision is sealed into a hash chain an auditor can check without our cooperation. This page is a complement page: most of our design conversations assume a gateway is present. It's about which obligations land in the pipe and which land in the data.
The short version
Pick DataShield when
- The risk you're carrying is the raw PII sitting in your datasets before any prompt is written. A proxy can only redact what flows past it. We remove the value from the dataset itself.
- Someone will eventually ask you to prove an agent's access log wasn't edited. Gateway audit logs are rows in Postgres or ClickHouse that an admin can update. Ours is a hash chain with signed, chained checkpoints. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next governed tool call fail closed, without waiting on a token refresh.
- You have a GDPR Article 17 erasure to answer and the subject's values are scattered through logs, traces, and caches. Crypto-shred gives you an answer that keeps the audit chain valid.
Pick an AI gateway when
- You need inline blocking. If a request has to be stopped in flight, that's a proxy's job, and we don't have an inline product. Kong's AI PII Sanitizer and Prisma AIRS both do this and we don't.
- Model routing and cost control are the problem: failover, token-aware rate limits, spend caps, semantic caching. LiteLLM reports 140+ providers and a Rust gateway at 0.66ms p99 overhead. We offer none of this.
- You want to start in an afternoon. LiteLLM's OSS tier is free forever and installs with pip; TrueFoundry starts free. We're a data-platform deployment.
- Your estate already runs on Kong or Palo Alto and the path of least resistance is the incumbent's MCP registry.
Bottom line: run both. A gateway in front of raw PII is a filter. A gateway in front of tokenized data is defense in depth, and only one of those two things survives a detector miss.
Feature by feature
Competitor cells describe what Kong, LiteLLM, Portkey/Prisma AIRS and TrueFoundry's public sites and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | AI gateways | Edge |
|---|---|---|---|
| Point of control | The data layer and the MCP tool boundary. Datasets are tokenized at ingest, so protection travels with the data rather than the route. | An inline proxy on traffic between apps or agents and model providers. Control starts where the request passes through. | — |
| Data at rest | Tokenized and generalized datasets, with masking-by-default SQL views. Deterministic, join-preserving, vault-reversible tokens plus k-anonymity on quasi-identifiers. | Not addressed. Raw PII stays in every source dataset; the gateway sees it only if it is routed. | ◆ |
| Missed detection | A detector miss has nothing to reveal, because the sensitive value isn't in the queryable dataset to begin with. | A miss means the value reaches the model, the traces, and the gateway's own logs and caches. Redaction fails open. | ◆ |
| Inline blocking and redaction | None, by design. We have no inline SKU and traffic that never touches our MCP surface is not governed by us. | Core strength. Kong's AI PII Sanitizer covers 20 categories across 9 languages with placeholder or synthetic replacement; Prisma AIRS adds threat guardrails; LiteLLM wires up external Presidio containers. | ◇ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification distinguishes tampering, insertion, deletion, and truncation. Public verifier. | Request logging and observability dashboards. We found no published cryptographic tamper evidence from any gateway in this category. | ◆ |
| Agent authorization | Each governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch, then gets metered and sealed into the chain. | Route and tool allowlists, virtual keys, team budgets. TrueFoundry is furthest along with tool-level RBAC and Cedar policies; LiteLLM has MCP guardrails but no central tool ACL. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. | Not offered by any gateway we looked at. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after the subject is gone. | Redaction is one-way and no erasure story is published for values the detector missed and then logged. Enkrypt's gateway even auto-unredacts responses inline, which round-trips cleartext. | ◆ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and per-call metering is attributed to the agent. | Now table stakes across the category: Kong shipped an MCP Registry inside Konnect, LiteLLM routes MCP servers through the same gateway, TrueFoundry ships a purpose-built MCP gateway. | ◈ |
| Model routing and cost | Not offered. This is the gateway's job and we say so on sales calls. | Strength. Failover, semantic caching, spend caps, per-team budgets. LiteLLM publishes 140+ providers and 0.66ms p99 overhead on its Rust gateway. | ◇ |
| Deployment | Self-hosted, in your VPC, or BYOC. Your keys. | Varies. LiteLLM self-hosts via pip, Docker, or Kubernetes; Kong offers Konnect SaaS plus self-hosted and hybrid; TrueFoundry covers on-prem, VPC, hybrid and cloud; Prisma AIRS is SaaS under Palo Alto. | ◈ |
| Maturity signals | Auth v1.0 live. Guardian and Lighthouse v0.2, in production since April 2026. SOC 2 not yet certified, and we say so. | Much older and much larger. Kong is an API incumbent, LiteLLM reports 240M+ Docker pulls and 53K+ GitHub stars, and Portkey now sits inside Palo Alto Networks. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Partly published. LiteLLM has a free forever OSS tier with Enterprise quote-only; TrueFoundry starts free with Pro from $499/month; Kong's AI Gateway page routes to a request-pricing form, with a legacy figure around $34.25 per million requests that we could not re-confirm for 2026; Prisma AIRS is quote-only after the rebrand. | ◈ |
◆ DataShield leads◇ AI gateways leads◈ comparable
Gateway claims are drawn from konghq.com, litellm.ai, portkey.ai and truefoundry.com, last checked 13 September 2026. Kong's per-request figure is a legacy number we couldn't confirm this year, so treat it as an order of magnitude and put the question to them.
Three things you get here that you won't get from a gateway
Protection that exists before the proxy does
A gateway can only act on traffic it sees. Tokenization happens at ingest, so the sensitive value is gone from the dataset whether or not a request ever routes through anything. Deterministic tokens still join, so your analytics survive. How the data layer works.
Logs that are evidence, not just records
Gateway audit logs are application rows in Postgres or ClickHouse, and an admin with write access can change them. Under EU AI Act Article 12 that's worth roughly nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what went wrong, not just that something did. Run it in a browser tab.
The virtual key that outlives the analyst
Someone's access is pulled at 16:00. Their agent is halfway through a long batch. The gateway keeps routing, because the virtual key is still valid. Here, the next governed tool call is re-checked against current authority and fails closed. How Auth does it.
Where AI gateways are genuinely stronger
Almost everything about the request path. Routing across providers, failover when one goes down, semantic caching, token-aware rate limits, spend caps per team, and the ability to actually stop a request in flight. Kong's sanitizer handles 20 PII categories in 9 languages. LiteLLM's numbers are real and its OSS tier costs nothing. TrueFoundry runs on-prem and now ships tool-level RBAC with Cedar policies, which is closer to our territory than anything else in the category. Every one of these products is older, bigger, and easier to install than we are, and the whole category went MCP-native inside twelve months. If you have no gateway, get one before you call us.
So where's the argument? Redaction at the proxy is late and lossy: it sees only routed traffic, catches only what the detector recognizes, and the placeholders it leaves behind don't join or aggregate. It's also one-way, so there's no path back for a legitimate use and no erasure story for the values that got logged. And none of it touches the raw PII already sitting in your warehouse. Through 2028 Gartner expects most unauthorized agent transactions to be internal policy violations rather than attacks. That's a governance problem wearing a filtering problem's clothes. A filter can't tell you whether the agent was allowed to make the call, and a mutable log can't prove what it did.
Questions worth asking both of us
Ask your gateway vendor these. Then ask us the same ones.
What stops an agent from bypassing DataShield entirely?
Nothing, and we won't pretend otherwise. We are not an inline proxy and we don't intercept prompt traffic. The answer is that bypassing us doesn't buy the caller much: datasets are tokenized at ingest, so an agent that skips every control still finds tokens rather than raw values, and reaching a governed tool still requires a valid MCP tool token issued by Auth with a scope ceiling attached. The protection lives in the data, not in the pipe. If you need traffic stopped in flight, that's what the gateway is for, and we assume you have one.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Rows commit forward, checkpoints are Ed25519-signed and chained to each other so a missing checkpoint surfaces too, and verification reports which failure it found. The chain at /verify is live; try to fool it. Gateways: we found request logging and observability across Kong, LiteLLM, Portkey/Prisma AIRS and TrueFoundry, but no published tamper-evidence mechanism. Ask any of them to verify a chain live.
What happens to a revoked agent mid-session?
We evaluate current authority on every governed tool call, so the call after a revocation fails, not the call after the next token refresh. Gateway virtual keys and budgets are checked at the proxy, and we found no description of mid-session authority downgrade in any of their public docs. Ask for the number: after you pull access, how many more calls can that key make?
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material and issue an ISO 27560 receipt. Nothing is deleted from the chain and it still verifies, because actor identities in it are HMAC commitments. On the gateway side, ask the harder version of the question: a subject's values were missed by the detector six months ago and now sit in request logs, traces, and the semantic cache. What's the deletion procedure, and what does it do to the logs you rely on for audit?
Do we have to choose between you?
No, and most of the teams we talk to don't. The gateway governs the pipe and we govern the data. Running LiteLLM or Kong in front of tokenized datasets is strictly better than running it in front of raw ones, because a detector miss stops being an incident. The only time this turns into a real either-or is when a buyer believes gateway redaction is their compliance program. It isn't, but that's an argument about scope rather than about products.
Does DataShield have SOC 2?
No. Auth is v1.0 with a published threat model and a verifier anyone can run; Guardian and Lighthouse are v0.2 and have been in production since April 2026. Design-partner terms include source escrow, and because the stack self-hosts, our uptime isn't your uptime. Security page.
- Kong AI Gateway is positioned as unified control for LLM, MCP, and agent-to-agent traffic, and shipped an MCP Registry inside Konnect in 2026. Pricing is a request form, not a number. — konghq.com, 13 Sep 2026
- LiteLLM: "The AI Gateway for platform teams." 140+ providers, 240M+ Docker pulls, 53K+ GitHub stars, Rust gateway at 0.66ms p99 overhead. Free forever OSS tier; Enterprise is quote-only. — litellm.ai, 13 Sep 2026
- Portkey is being folded into Palo Alto Networks' Prisma AIRS AI Gateway, generally available August 2026. No published pricing after the rebrand. — portkey.ai, 13 Sep 2026
- TrueFoundry: "The Enterprise AI Gateway for LLMs, MCPs & Agents," deployable on-prem, VPC, hybrid or public cloud. Starts free, Pro from $499/month. — truefoundry.com, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
- EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024
Other head-to-heads
DataShield vs MintMCP
An MCP-only gateway with SSO and allowlists, against tokenized data and a verifiable chain.
ComplementDataShield vs Lakera
Prompt-layer defence and data-layer governance solve different halves.
DirectDataShield vs Skyflow
A privacy vault with an inline gateway, versus agent authorization and evidence.
AllEvery comparison
Eleven vendors, one honest scorecard each.
Keep your gateway. Then see what sits underneath it: break a live audit chain, revoke an agent mid-session, and query a tokenized dataset. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →