Head-to-head · updated 13 September 2026

DataShield vs Basis Theory: is a payments vault the right home for your PII?

Basis Theory is a good programmable payments vault. Their hero says it plainly: "Built to keep customers transacting." If your sensitive data is a card number in a checkout flow, they hold it, keep you out of PCI scope, mint network tokens, refresh expired cards and route the charge to whichever processor is up. They publish a starting price too, which almost nobody in this market does.

We sell a different thing. DataShield tokenizes whole datasets of PII and PHI at ingest, then governs what your AI agents may do with them. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Below is where the two really differ, sources included, and yes, the rows Basis Theory wins.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

The sensitive data is PII or PHI spread across datasets, not a card in a checkout. We tokenize at ingest, keep joins intact across tables, and generalize quasi-identifiers (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails), with a measured cardinality-reduction score per column. See the data layer.
An auditor will one day ask you to prove an access log wasn't edited. Our chain answers that with math. Run the verifier.
You need to pull an agent's authority mid-session and have its very next tool call fail, not wait for a token to expire. How Auth does it.
The vault, the policy engine and the evidence must sit on your own infrastructure, with keys you hold. Architecture.

Pick Basis Theory when

Your problem is cards. PCI Level 1, an Attestation of Compliance and answers for most of SAQ D are on their pricing page. We have no PCI story at all.
You want payment performance, not just storage: network tokens, account updater, BIN data and routing across several processors so a failed charge retries somewhere else.
You need to keep raw card entry out of your own systems with client-side form elements that post straight to their vault.
You're a small team that wants to start on a published $995 a month plan and be live this week.

Bottom line: Basis Theory keeps card data out of your scope. DataShield governs what an agent may do with PII and keeps proof of it. Plenty of teams will run both, and that's fine. If your exposure is agents touching health or customer records, start here.

Feature by feature: tokenization platform against programmable payments vault

Competitor cells describe what Basis Theory's public site and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.

What matters	DataShield	Basis Theory	Edge
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Public verifier.	Logs are a plan feature: 24 hours of retention on the Starter tier, custom access at Enterprise. We found no published cryptographic tamper evidence.	◆
Agent authorization	Every governed tool call passes a scope ceiling, a declared authority tier and a revocation re-check before dispatch. Revocation lands mid-session.	Their agentic commerce page describes scoped agent access and permission controls for payment credentials. That governs the card, not the agent's wider authority.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes and can't be quietly deleted from the log.	Not described in their public docs.	◆
GDPR erasure	Crypto-shred of per-subject key material plus ISO 27560 consent receipts. The audit chain still verifies after erasure.	Token deletion via API. We couldn't find a documented erasure mechanism tied to key destruction or to audit history.	◆
Tokenization	Deterministic, join-preserving, vault-reversible tokens applied at ingest across whole datasets, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is privileged and logged.	Mature token API with aliasing, masks, expressions and proxy detokenization. Built for a credential in a transaction rather than analytical joins across tables.	◈
PII and PHI scope	First-class: classification and generalization ship in the base dataset platform.	"Additional compliance options for PII and PHI data" sit at the Enterprise tier. The Starter plan is a PCI environment.	◆
Payments and PCI	No PCI attestation. Not our market, and we won't pretend otherwise.	PCI Level 1, AOC included, and responses for 95% of PCI SAQ D. Home turf.	◇
Payment performance tooling	None. We don't touch authorization rates.	Network tokens, account updater, BIN service, smart routing and backup routing across processors.	◇
MCP and agents	Native MCP endpoints on Auth, Ontology and Lighthouse. MCP tool tokens with scope ceilings, and per-call metering attributed to the agent.	Active agentic commerce push since mid-2026, aimed at accepting agent-initiated payments. No MCP server found in their docs.	◆
Deployment	Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys.	SaaS only. The Starter plan is a US environment; other regions appear to need an Enterprise conversation.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	Founded 2020. PCI Level 1, SOC 2 Type II, ISO 27001, HIPAA, named customers, monthly changelogs.	◇
Pricing	Published model and a scoped instant quote, no sales wall.	Starter at $995 a month for 20,000 tokens. Scale is unpriced and Enterprise is a call, but they show a real number, which we respect.	◈

◆ DataShield leads◇ Basis Theory leads◈ comparable

Basis Theory claims are drawn from basistheory.com, their pricing and security pages and their blog, last checked 13 September 2026. We link them below rather than paraphrase from memory.

Three things you get here that you won't get from a payments vault

Proof that survives an audit

A log that can be quietly edited is worth little to an examiner. Ours is a hash chain with signed checkpoints, and the verifier says what went wrong, not just that something did. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

A nurse informaticist resigns on a Tuesday. Her agent is halfway through a 40-minute cohort job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A vault token just keeps working until it expires. How Auth does it.

An erasure you can defend

GDPR says delete. Your auditor says keep the log. Crypto-shred settles it: the subject's key material is destroyed, the data becomes unreadable, and the chain still verifies. See the diagram.

Where Basis Theory is genuinely stronger

Let's be fair to them. Basis Theory has PCI Level 1, SOC 2 Type II, ISO 27001 and HIPAA on the wall, and they ship monthly. Their token API is older and more polished than ours for single-credential work. Network tokens, account updater and BIN data are real revenue tools that we will never build. And they publish $995 a month on a public page while most of this market hides behind a demo form. That takes some nerve, and it earns the pricing row as a draw.

Here's the push-back. Their own blog argues that a chatbot with access to card data lands you in PCI scope, and that AI is making that a problem nobody is talking about. We agree. But scope is only the first question. The second one is whether the agent was allowed to make the call at all, and the third is whether you can prove the answer six months later. A vault log with 24 hours of retention on the entry plan does not settle either. On their agent payments post they write that agent identity and cardholder identity are not the same thing. That sentence is the whole reason we exist, and they wrote it about someone else's problem.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it on a sample chain at /verify. Basis Theory: their pricing page treats logs as a retention feature, 24 hours at Starter. We found no tamper-evidence mechanism published. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation bites on the next call. Basis Theory describes scoped agent access for payment credentials on their agentic commerce page, which is about what an agent may spend. Ask how fast a pulled permission stops an agent that is already running.

Is Basis Theory a fair choice for PII and PHI, not just cards?

It can be, at a price. Their pricing page lists "additional compliance options for PII and PHI data" at the Enterprise tier, so the published $995 Starter plan is a PCI environment rather than a PII one. Ask what the PII tier costs. In DataShield, PII and PHI classification across 129 field classes and quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column are part of the base dataset platform.

Do your tokens still join across datasets?

Ours do. The same input yields the same token, so a patient ID in a claims table still matches the one in an encounters table, and analysts can work without ever seeing the raw value. Basis Theory supports deterministic aliasing too, but the product is tuned for a credential inside a transaction. If your use case is cross-table analytics, ask for a worked example.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence stays verifiable after the subject is gone. Basis Theory offers token deletion; the effect on audit history isn't described in public docs. Ask whether erasing a subject breaks the log.

Does DataShield have SOC 2 or PCI?

Neither, and we won't imply otherwise. Basis Theory has both, plus ISO 27001 and HIPAA, and that is a real gap. What we offer instead: Auth is live a public threat model and a verifier anyone can run, Guardian and Lighthouse have been in production since April 2026, and design-partner terms include source escrow. Details on the security page.

Basis Theory's hero: "Built to keep customers transacting." Products listed include Payment Vault, Network Tokens, Account Updater and Enhanced BIN Service. — basistheory.com, 13 Sep 2026
Starter plan $995/month, 20,000 tokens, 1MB payload, 24 hours of logs, US environment only. PII and PHI compliance options and 95% of PCI SAQ D responses sit at Enterprise. — basistheory.com/pricing, 13 Sep 2026
PCI Level 1, SOC 2 Type II, ISO 27001 and HIPAA certifications, with no published detail on key custody, residency or erasure. — basistheory.com/security, 13 Sep 2026
"Agent identity and cardholder identity are not the same thing." Agents authorised by mandates with spending ceilings rather than per-transaction approval. — Basis Theory blog, 8 Sep 2026
"AI is making customer support conversational, and it's becoming a PCI compliance problem nobody is talking about." — Basis Theory blog, 6 Aug 2026
EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024

Other head-to-heads

Direct

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →