Head-to-head · updated 13 September 2026
DataShield vs Bedrock Knowledge Bases: who checks the retrieval was allowed?
Bedrock Knowledge Bases does the boring part of RAG well. Point it at S3, SharePoint, Confluence or Google Drive and AWS parses the files, chunks them, embeds them, reranks the hits, then hands your agent an MCP tool. Agentic retrieval will even split a hard question into sub-queries and stream back a cited answer. AWS calls the job "grounding agents and applications on enterprise data". If your estate is on AWS, this is already on the bill.
We work a layer below the retriever. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings are made on your own hardware by a local model, the vectors sit in your own Postgres, and every governed call lands in a hash chain you can verify without trusting us. Most AWS shops should run both. Here is where each one earns its keep, sources at the bottom.
The short version
Pick DataShield when
- Someone will one day ask you to prove the retrieval log wasn't edited. CloudTrail tells you what happened. It can't tell you the record is intact. Run the verifier.
- Your documents carry PHI or regulated PII and you'd rather the index carried tokens. A leaked vector store then leaks
TOK_strings, not names. See how the ontology maps it. - Embeddings must not leave the building. Ours are made locally by a small open model and land in your own Postgres
pgvector. - Part of the estate isn't on AWS. We ship Docker images, run on your tin, and the audit chain verifies wherever you take it.
Pick Bedrock Knowledge Bases when
- You want the managed pipeline: seven connectors, smart parsing of PDFs, decks and scanned pages, with embedding and reranking included at no extra charge.
- You want agentic retrieval. It plans sub-queries, searches across several knowledge bases, judges whether it has enough, then streams a cited answer. We do hybrid keyword and vector search. We don't do that.
- You want document ACLs crawled for you from SharePoint, OneDrive, Google Drive and Confluence, re-checked live at query time, failing closed on error. That is real work, done well.
- Zero ops is the point. $5 per GB per month and $1 per 1,000 retrievals, on a bill your finance team already signed.
Bottom line: Bedrock retrieves. We govern what's in the chunk, who may ask for it, and what you can show later. On AWS, run both: keep the managed pipeline and tokenize before it indexes.
Feature by feature
Competitor cells describe what AWS's public site and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Bedrock Knowledge Bases | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Try the verifier demo. | CloudTrail for API calls, plus AgentCore Observability traces and per-knowledge-base metrics. Good for debugging. We found no published tamper-evidence mechanism for that data. | ◆ |
| Who the retrieval is for | Auth issues MCP tool tokens with a scope ceiling, re-checks authority on every governed call, and meters the call against the agent. Ontology's MCP server gates each tool by API-key tier. Identity is checked, not supplied. | ACL-aware retrieval filters on a user context your application passes in. AWS states plainly that it does not authenticate end users and that this "does not constitute true authorization". Email is the only user identifier, with no cross-provider mapping. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. | Not described in the docs we read. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor ids are HMAC-committed, so the chain still verifies after erasure. | Standard AWS deletion and retention controls, and you re-sync the data source. What erasing a person does to retrieval history isn't documented. | ◆ |
| Sensitive data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Chunk views also mask at read time and rebuild the keyword index from the masked text, so search can't be used to probe for a redacted value. | Guardrails run at retrieval and generation. Nothing de-identifies field values before they're embedded, and AWS documents that the sensitive-information filter does not evaluate PII in tool call arguments, tool results or tool definitions. | ◆ |
| Document-level access filtering | Access is by dataset, role and tier, not by crawled document ACL. We don't read your SharePoint permissions. If that's the job, they do it and we don't. | Crawls allow and deny lists for users and groups, re-verifies live against SharePoint, OneDrive, Google Drive and Confluence, and fails closed. S3 and Custom sources rely on a metadata file you maintain. | ◇ |
| Retrieval and ingest pipeline | Hybrid keyword and vector search over pgvector. Ingest from files, URLs and S3-compatible storage, with PDF, DOCX and EML extraction. Corpus promote and demote are audited. No graph retrieval, no managed reranker. | Seven connectors, smart multimodal parsing, managed embedding and reranking at no extra charge, hybrid search, GraphRAG on Neptune, NL2SQL over Redshift, and agentic multi-hop retrieval. Broader than us, by a distance. | ◇ |
| Embedding and index custody | Local nomic-embed-text embeddings, 768 dimensions, into your own Postgres pgvector table. No text and no vectors leave your infrastructure to be embedded. | The managed datastore is "managed completely by Bedrock" with no direct access. Bring your own vector store is still supported, but it gives up connectors, agentic retrieval, ACL filtering and the gateway target. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Retrieval, catalog, classification and audit sit behind one surface. | AgentCore Gateway exposes a managed knowledge base as two MCP tools, Retrieve and AgenticRetrieveStream, with admin-controlled parameter subsetting. Managed knowledge bases only, IAM auth only. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. Your keys. | AWS regions only. Not self-hostable. Fine if you're all in on AWS, awkward if a residency rule or a second cloud says otherwise. | ◆ |
| Maturity signals | Live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | GA since November 2023, with OpenAI, Syngenta, MRH Trowe and Sony named on the product page, and the whole AWS assurance programme behind it. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Published per-unit rates: $5.00 per GB of raw data per month, $1.00 per 1,000 Retrieve calls, $4.00 per 1,000 agentic calls on top. Cheap, and visible without a call. | ◈ |
◆ DataShield leads◇ Bedrock Knowledge Bases leads◈ comparable
Knowledge Bases claims are drawn from aws.amazon.com and the Amazon Bedrock User Guide, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from a managed RAG service
Tokens in the index, not names
A vector store is a copy of your documents in a shape nobody reviews. Tokenize the sensitive fields at ingest and that copy holds TOK_ strings. The mapping lives in the ontology, the key custody story is on the security page, and a lookup is an admin-tier call that is audited before it returns. Tokens stay join-friendly, so analytics still work.
An identity the service checked
Bedrock's ACL filter trusts the email your app hands it. That is a fine design, and AWS says so in the docs. It just means the strength of the filter is the strength of your app. Our MCP tool tokens carry a scope ceiling the holder can't exceed, and authority is re-checked on every governed call, so an analyst who leaves at 2pm stops working at 2pm. How Auth does it.
Proof that travels
Traces live in the account that made them. Evidence should outlive the platform. Our audit rows chain to each other, checkpoints are signed, and the verifier says which of tampering, insertion, deletion or truncation it found. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Where Bedrock Knowledge Bases is genuinely stronger
On retrieval itself, they win. Seven connectors, a parser that copes with scanned pages and slide decks, a managed embedding model and a managed reranker thrown in free, hybrid search, graph retrieval on Neptune, NL2SQL over Redshift, and agentic retrieval that plans sub-queries and streams a cited answer. Our RAG is hybrid keyword and vector search over pgvector, with honest ingest and audited corpus moves. It is good, and it is narrower. Their ACL crawling is also better than the usual hand-waving: allow and deny lists from four SaaS sources, deny beats allow, live re-verification at query time, and a fail-closed rule so a timeout returns nothing rather than too much. Then add the AWS bill you already signed. I'd find that hard to argue with too.
Here's the push-back, and it comes from AWS's own page. The heading reads "ACL awareness is not authorization", and the text underneath says Bedrock does not authenticate end users, cannot verify the identity context you pass, and that you must not rely on the feature as a sole access control mechanism. The identifier is an email with no alias resolution and no cross-provider mapping, and group membership is only as fresh as the last sync. Meanwhile nothing in the pipeline changes what's inside the chunk before it is embedded. So the index holds raw values, the filter trusts a string, and the record of what was retrieved is telemetry. Fix those three and the managed pipeline gets a lot easier to defend in a room with an auditor in it.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove a retrieval log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion from truncation from tampering. Try it at /verify. Bedrock: CloudTrail records the API call and AgentCore Observability holds the traces. We found no published tamper-evidence mechanism for either. Ask AWS what stops a log group being shortened, and what you would hand an examiner.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation bites on the next call. For Bedrock, the retrieval itself is gated by the IAM role that calls it and by the user context your app passes. We found nothing that pulls an in-flight agent's access to a knowledge base. Ask how long a compromised agent keeps retrieving after you pull its access, and who is responsible for noticing.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so evidence still verifies after the subject is gone. For Bedrock you delete the source document and re-sync, which handles the index. What we couldn't find is what erasing a person does to the retrieval history. Ask whether erasure breaks the record you'd rely on.
Is Bedrock's ACL-aware retrieval an access control?
AWS says no, in a heading. "ACL awareness is not authorization" is their wording, followed by a plain statement that Bedrock does not authenticate end users and that you must not rely on the feature as a sole access control mechanism. It filters on an email your application supplies. That is a reasonable split of duties. It does mean the upstream identity check is yours to build, and many teams reach for metadata filters instead, which AWS documents as a relevance feature, not a security one.
Where do our embeddings and documents actually live?
With us, on your infrastructure. Text is embedded locally by nomic-embed-text and stored in your own Postgres pgvector table. With a Bedrock managed knowledge base, the datastore is, in AWS's words, "managed completely by Bedrock", inside AWS regions, with no direct access. You can bring your own vector store instead, but that path gives up the connectors, ACL filtering, agentic retrieval and the AgentCore Gateway target. Ask which half of the product you are actually buying.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. You're comparing a young product from a small team against AWS, so weigh that honestly. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow so a small vendor isn't a single point of failure. Details on the security page. If you're already on AgentCore, our head-to-head on that covers the runtime side.
- Knowledge Bases positioning: "Give foundation models and agents contextual information from your company's proprietary data sources", under the banner "Grounding agents and applications on enterprise data". — aws.amazon.com/bedrock/knowledge-bases, 13 Sep 2026
- AWS documents ACL-aware retrieval under the heading "ACL awareness is not authorization": Bedrock "does not authenticate end users", the filter "does not constitute true authorization", and email is the universal identifier with "no alias resolution or cross-identity-provider mapping". — Amazon Bedrock User Guide, 13 Sep 2026
- Managed knowledge bases get seven connectors, agentic retrieval and AgentCore Gateway integration; customer-managed ones get S3 and Custom connectors, and the managed datastore is "managed completely by Bedrock". — Amazon Bedrock User Guide, 13 Sep 2026
- Published rates: $5.00 per GB of raw data per month for index storage, $1.00 per 1,000 Retrieve calls, and $4.00 per 1,000 agentic retrieve calls plus the underlying retrievals. Managed parsing, embeddings and reranking are included at no extra charge. — aws.amazon.com/bedrock/pricing, 13 Sep 2026
- AgentCore Gateway exposes a managed knowledge base as two MCP tools,
RetrieveandAgenticRetrieveStream, "supported only for managed knowledge bases, and only with IAM-based outbound authentication". — Amazon Bedrock User Guide, 13 Sep 2026 - Bedrock Guardrails sensitive-information filters "evaluate text content only" and in tool-use workloads do not evaluate PII in tool call arguments, tool results, or tool definitions. — Amazon Bedrock User Guide, 13 Sep 2026
Other head-to-heads
DataShield vs Azure AI Search
DataShield vs Azure AI Search: Azure wins retrieval scale and permission-aware knowledge bases. DataShield.
Same marketDataShield vs LlamaIndex
DataShield vs LlamaIndex: LlamaIndex wins document parsing and extraction. DataShield adds tokenized data,.
Same marketDataShield vs Cortex Search
DataShield vs Snowflake Cortex Search: Cortex Search is fast managed RAG inside Snowflake. We add tokens.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
Already indexing into Bedrock? Good, keep it. Come see the two things it leaves to you: tokenize a dataset so the index holds TOK_ strings, then break a live audit chain and watch the verifier name exactly what you did. Demo Center access is free with a work email.
You've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →