Head-to-head · updated 13 September 2026
DataShield vs Amazon DataZone: what governs the data your AWS catalog can't reach?
Amazon DataZone is the business data catalog for an AWS estate, and since re:Invent 2024 it is also the engine under Amazon SageMaker Catalog. Its own page calls it "a data management service that makes it faster and easier for customers to catalog, discover, share, and govern data stored across AWS, on premises, and third-party sources." A producer publishes a Glue table. A consumer asks for it. An owner approves, and Lake Formation grants the access for real. If your data lives in Glue and Redshift, that loop is hard to beat, and it now costs you almost nothing per user.
We sell the next layer, and a different blast radius. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Fields are labelled against 129 PII, PHI, financial and secret classes, with reproducible verdicts. Every governed tool call is checked against the agent's current authority before it runs, and each decision is sealed into a hash chain you can verify yourself. None of that needs an AWS account.
The short version
Pick DataShield when
- Your sensitive data is not all in AWS. DataZone grants real access only to Lake Formation managed Glue tables and Redshift. Everything else is an EventBridge event you have to wire up.
- You want PII and PHI labels in the catalog itself, not in a second console with its own bill. DataZone has no built-in classifier. See what we label.
- Agents act on the data, and you need per-agent authority that can be pulled mid-session. AWS agents inherit IAM. IAM does not reach inside a running plan. How Auth does it.
- An examiner asks you to prove a March access record was not edited. CloudTrail is a log. Ours is a signed chain. Run the verifier.
Pick Amazon DataZone when
- Your estate is Glue, Redshift, Athena and S3. The catalog is already in the account, and the grant path has no sync lag.
- You want the subscribe and approve workflow. A consumer asks, an owner clicks, permissions appear. That is a real product, and most catalogs only record the decision.
- You need column-level lineage from Spark jobs on EMR and Glue, plus data quality rules from Glue Data Quality. Both shipped in 2026.
- Cost matters more than portability. There is no per-user fee since November 2024, and core APIs are free.
Bottom line: if you live in AWS, keep DataZone. It catalogs the platform it lives on, and it grants access there better than we do. It cannot label your PHI, follow your data to another cloud, or hand an auditor proof that a query was allowed. That is our half.
Feature by feature: an AWS data and AI catalog versus a governed data plane for agents
Competitor cells describe what the Amazon DataZone and SageMaker Catalog pages, the DataZone user guide, and the Unified Studio release notes say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Amazon DataZone | Edge |
|---|---|---|---|
| Catalog breadth | Assets, columns, a business glossary materialized from entity types, typed lineage, and a 29-command stewardship workflow. We register a provider over a live connection and scan it in place, with no rows leaving it. That is PostgreSQL today, not your whole estate. Snowflake, BigQuery, Databricks, S3 and Salesforce are declared with no handler yet. | Glue Data Catalog tables, Redshift, S3 object collections, BI dashboards, ML models, and custom asset types. Teradata and OpenSearch arrived in July 2026. Metadata also syncs both ways with Collibra, Atlan and Alation. | ◇ |
| Where access is actually enforced | At our own read path. Queries run against masked views and tokenized columns, and every governed tool call passes a scope gate and an authority check first. Same rules on any cloud or none. | The user guide is blunt about the edge: access grants cover Lake Formation managed Glue tables and Redshift tables and views. For all other assets, DataZone emits an EventBridge event and you build the fulfilment. | ◆ |
| PII and PHI classification | 129 field classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers. Regex, checksum validation, column-name lexicons and anti-pattern suppressors, no model, so a verdict is reproducible from a config digest. | None built in. The catalog carries business metadata and Glue Data Quality rules. For sensitive data you add Macie or Glue sensitive data detection, each billed on its own. | ◆ |
| Tokenization and data handling | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic, join-preserving and vault-reversible. Quasi-identifier generalization is there too: dates to year, decade or age band, ZIPs to 3 or 4 digits, partial phones, SSNs and emails, with a measured cardinality-reduction score per column. | No tokenization, masking or generalization engine. The catalog describes data; it does not transform it. | ◆ |
| Sample values in the catalog | Default policy is omit: no column value is copied into the catalog at all. Storing plaintext samples needs an explicit acknowledgement and writes an audit row. | We could not find a documented sample-value policy for catalog assets. Worth asking them what profiling retains, and where. | ◆ |
| Lineage | Typed lineage over an edges vocabulary with both-endpoint access gating at every hop, plus impact traversal. It is derived from the pipelines that own the relationships, not a stored column-level graph. | OpenLineage-compatible lineage from Spark on EMR, Glue, Visual ETL and notebooks, an aggregated job view since March 2026, and column-level lineage on the SageMaker Catalog page. Deeper than ours. | ◇ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, a declared authority tier, and a revocation re-check before dispatch. Revocation bites on the next call. Delegation is RFC 8693 token exchange with an enforced scope ceiling. | Agents inherit IAM and Lake Formation grants. SageMaker Data Agent reads catalog business context, and Amazon Q Developer supports MCP servers, but we found no per-agent identity, scope ceiling or mid-session revocation in the product docs. | ◆ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Signing keys can sit in your KMS or HSM. Try the verifier. | Usage auditing in the portal, EventBridge events, and CloudTrail for API calls. Useful records, and mutable ones. No cryptographic tamper evidence is described. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, IP-allowlisted and step-up gated. It auto-revokes and cannot be quietly removed from the log. | Not offered. The emergency path in AWS is an IAM role change, which nothing forces you to time-box. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the audit chain still verifies after erasure. | No erasure mechanism. The catalog can tell you where a subject's data sits. Deleting it stays your job in S3, Redshift or wherever it landed. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings and meters every call against the agent that made it. Ontology's MCP surface authenticates by API key with per-tool tier gating. | Amazon Q Developer in Unified Studio integrates MCP servers, and re:Invent 2025 demoed analytics MCP servers across Glue, Athena, Redshift and EMR. The SageMaker Catalog page itself makes no MCP claim. | ◆ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse, and Guardian verifies a signed deploy manifest. | AWS-managed, AWS-only, per region. There is no self-hosted or on-premises option, and none is on the public roadmap. | ◆ |
| Maturity signals | Live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. Field classification cut over from shadow mode very recently, which we would rather tell you than have you find out. | GA since October 2023, rebadged as SageMaker Catalog in December 2024, with a heavy 2026 release cadence. Named customers include Natera, Cisco and NatWest. It inherits the AWS compliance estate. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Published and cheap at the catalog layer: $10 per 100,000 requests, $0.40 per GB-month of metadata, $1.776 per compute unit, and per-token charges for AI recommendations. No per-user fee since 1 November 2024. The real bill is the Glue, Athena, Redshift and Bedrock usage underneath. | ◈ |
◆ DataShield leads◇ Amazon DataZone leads◈ comparable
Amazon DataZone claims are drawn from aws.amazon.com/datazone, the DataZone user guide, aws.amazon.com/sagemaker/catalog, the DataZone pricing page, and the SageMaker Unified Studio release notes, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from a platform catalog
Labels on the data, not just around it
A catalog entry tells you a table exists and who owns it. It does not tell you that column 14 is an MRN. We label fields against 129 classes, including all 18 HIPAA Safe Harbor identifiers, with no model in the loop. Same input, same verdict, every time. See the catalog.
Proof that survives an audit
CloudTrail tells you an API call happened. It cannot prove nobody edited the record after the fact. Our records form a hash chain with signed checkpoints, and the verifier tells you what went wrong, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
One rule set, any cloud
DataZone stops at the edge of your AWS account. Your PHI does not. Run our stack in your own data center, in another cloud, or on a single-tenant server we operate, and the same masking, the same tokens and the same audit chain follow the data. See the architecture.
Where Amazon DataZone is genuinely stronger
The subscription workflow is the good part, and I don't think people give it enough credit. Most catalogs record an approval and then email someone to go make it true. DataZone approves and grants, through Lake Formation or Redshift, with nothing to sync and nothing to drift. Add real column-level lineage from Spark jobs, Glue Data Quality rules, AI-written descriptions, and a metadata sync with Collibra, Atlan and Alation, and you have a serious catalog that costs almost nothing per seat. AWS also did the honest thing in late 2025 by exporting catalog metadata as an Iceberg table, so your inventory is queryable with plain SQL. That blunts the lock-in argument, and it should.
Here is the push-back. Read the scope line in their own user guide again: grants cover Lake Formation managed Glue tables and Redshift tables and views, and every other asset gets an EventBridge event. So the further your data sits from Glue, the more the product becomes a very good index of things it cannot control. Then add agents. SageMaker Data Agent now reads catalog context, which is useful and slightly alarming: the agent gets richer business meaning about your data while its authority is still a shared IAM role, logged to a mutable trail. A catalog that knows your data is sensitive but cannot stop a query, cannot pull an agent's authority mid-session, and cannot prove afterwards what was allowed, is doing two thirds of a job.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion from truncation from tampering. Try it at /verify. DataZone: it gives you portal usage auditing, EventBridge events, and CloudTrail. Those are logs, and logs can be edited by whoever holds the keys. Ask AWS what proves a record is unaltered, and who could alter it.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation bites on the next call. In AWS, the agent runs under an IAM role. Changing that role does not interrupt a plan already in flight. Ask how long a compromised agent keeps reading the tables SageMaker Catalog just described to it.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence stays verifiable after the subject is gone. DataZone has no erasure mechanism. It points at where the data sits. The deletion, and the defensible record of it, is yours to build.
Is this still DataZone, or is it SageMaker Catalog?
Both, for now. AWS's December 2024 press release says SageMaker Catalog is "built on Amazon DataZone," and the SageMaker Catalog page repeats it. As of 13 September 2026 the DataZone console, API, product page and pricing page are all still live, and AWS has announced no end of life. Still, the brand is clearly being folded in. If you are signing a multi-year plan, ask which console and API you build against, and what happens to existing DataZone domains.
Which of our non-AWS sources does DataZone actually govern?
This is the question we'd lead with. Their user guide says grants cover Lake Formation managed Glue tables and Redshift tables and views; for all other assets DataZone publishes an EventBridge event. So Teradata, OpenSearch, S3 object collections, and Snowflake or Databricks seen through Glue are catalog entries with a workflow you finish yourself. Ask for a demo of a subscription request being fulfilled on a non-Glue source.
We need PII and PHI labels. Does the catalog do that?
Not on its own. DataZone and SageMaker Catalog handle business metadata, glossaries, AI-written descriptions and Glue Data Quality rules. For sensitive data the AWS answer is Macie or Glue sensitive data detection, in another console with another bill. We classify inside the catalog, against 129 classes, and the label drives masking and tokenization on the same read path. Ask both of us to run the same messy table and compare the column list.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. AWS has the entire certificate wall and we don't. What we offer instead is a published threat model, a verifier anyone can run, and Docker images you host yourself so your data never leaves your network. Design-partner terms include source escrow, so a small vendor isn't a single point of failure. Details on the security page.
- SageMaker Catalog hero: "Discover, govern, and collaborate on data and AI securely," and the page states it is "built on Amazon Datazone." Named customers: Natera, Cisco, NatWest. — aws.amazon.com/sagemaker/catalog, 13 Sep 2026
- "Amazon DataZone supports granting access to AWS Lake Formation managed AWS Glue tables and Amazon Redshift tables and views. For all other data assets, Amazon DataZone publishes standard events … to Amazon EventBridge." — Amazon DataZone User Guide, 13 Sep 2026
- Published pricing: $10 per 100,000 requests, $0.40 per GB-month metadata storage, $1.776 per compute unit, $0.015 per 1K input tokens and $0.075 per 1K output tokens for AI recommendations. — aws.amazon.com/datazone/pricing, 13 Sep 2026
- "As of Nov 1, 2024, there is no monthly user-based subscription charge for Amazon DataZone"; metadata storage cut from $0.417 to $0.40 per GB. — AWS What's New, 8 Nov 2024
- 2026 catalog releases: aggregated lineage view (17 Mar), metadata sync with Atlan, Collibra and Alation (3 Mar), Glue Data Quality rule authoring (20 May), SageMaker Data Agent grounded in catalog business context (4 Jun), lineage in IAM-based domains (7 Jul), profiling and anomaly detection (18 Aug). — SageMaker Unified Studio release notes, 13 Sep 2026
- "SageMaker Catalog, built on Amazon DataZone" announced as the governance layer of the next generation of Amazon SageMaker. — Amazon press release, 3 Dec 2024
- Amazon DataZone reached general availability on 4 October 2023 with producer and consumer projects, business glossaries and ML-generated metadata. — AWS News Blog, 4 Oct 2023
Other head-to-heads
DataShield vs Amazon Macie
The AWS answer for finding PII, and the question that lands after it.
DirectDataShield vs Unity Catalog
The other platform catalog, and the same independence argument.
DirectDataShield vs Google Dataplex
Governance bundled with the cloud you happen to be on.
AllEvery comparison
One honest scorecard per vendor, sources at the bottom.
DataZone catalogs your AWS estate. See what the next layer does: break a live audit chain, revoke an agent mid-session, then decide. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →