Head-to-head · updated 13 September 2026
DataShield vs data.world: who owns the catalog now that ServiceNow does?
data.world spent nine years building an enterprise data catalog on a knowledge graph, and it shows. Search is good. The glossary is good. Stewards like living in it. Their hero line is "Turn data chaos into clarity," and on a large messy estate they often do. They also ship a real MCP server, hosted at api.data.world/mcp, with browser consent and a scoped token that expires in 30 days. That is a serious product and we will not pretend otherwise.
One thing changed in May 2025. ServiceNow bought them. The data.world press room has published nothing since, and ServiceNow's own May 2026 launch names "ServiceNow Data Catalog" and "Context Engine" without saying data.world once. So the real question is not catalog versus catalog. It is where the metadata about your regulated data lives, and who can prove what an agent did with it. We run the catalog, the classification, the agent authorization and the audit chain inside your own walls. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation.
The short version
Pick DataShield when
- The catalog must not live in someone else's cloud. Ours is self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate.
- Someone will one day ask you to prove an agent's access log was not edited. Our chain answers with math, not a policy PDF. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next governed tool call fail. Not the next token refresh.
- You do not want your data catalog to be a line item on your ITSM vendor's platform contract.
Pick data.world when
- You need to catalog the whole estate today. Their connector coverage is wide and ours is not.
- You already run ServiceNow. The catalog is being folded into Workflow Data Fabric, and one bill with one vendor is a real advantage.
- Business users will do the curating. Their search and glossary UX is built for analysts, and nine years of polish is hard to beat.
- You want the knowledge graph itself. It is genuinely good, and a proprietary graph built over a decade is not something you rebuild in a quarter.
Bottom line: most teams should run both. data.world tells an agent what a column means. DataShield decides whether that agent may read it, and keeps proof of the decision. The one case where you should think harder is when the metadata itself is sensitive and you would rather it never left your building.
Feature by feature
Competitor cells describe what data.world's public site, docs and ServiceNow's press releases say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | data.world | Edge |
|---|---|---|---|
| Catalog coverage | We register a provider over a live connection, scan it, and profile assets and columns in place. No rows leave the source. That is PostgreSQL today. Snowflake, BigQuery, Databricks, SQL Server, S3, Salesforce and Kafka are declared with no handler built yet, and we publish that list rather than hide it. | Wide connector coverage across warehouses, BI tools and SaaS, with on-premise collectors. This is the row they win, and it is not close. | ◇ |
| Knowledge graph and glossary | A business glossary materialized from entity types, shaped to ISO/IEC 11179, plus typed lineage you traverse with per-hop access gating. The lineage is derived from the pipelines that own it, not a separate graph database, and we say so. | A proprietary knowledge graph is the whole architecture. Nine years of it. They claim "4.2x more accurate insights" from it, though the method behind that number is not published. | ◇ |
| Field classification | 129 built-in field classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers. Regex plus checksum validation, column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. Scans store no column values by default. | Sensitivity labelling and governance workflows sit on the catalog. We found no published class count, no checksum validators, and no statement about whether sample values are stored. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns one of three verdicts: clean, attested damage, or tampered. It names the failure. Try the verifier. | Governance workflows and activity history. ServiceNow's own May 2026 launch says agents today connect to data sources with "no audit trail" and offers a registry as the fix. We found no cryptographic tamper evidence in either company's material. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, an authority tier and a revocation re-check before dispatch. Metering runs before the handler. The call fails closed. | The MCP server issues a scoped token after a browser consent screen, which is good practice. We found no per-call authorization decision point and no mid-session revocation. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes, is IP-allowlisted and step-up gated, and cannot be quietly removed from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the evidence still verifies after the subject is gone. | Governance and policy workflows. The underlying erasure mechanism is not described in their docs. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Masking and generalization are switches you turn on, not defaults. | Not part of the product. A catalog describes data; it does not transform it. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and delegation is RFC 8693 token exchange with an enforced ceiling. | A documented MCP server at api.data.world/mcp, fully hosted by them, with OAuth consent and a 30-day scoped token. Self-hosting it is explicitly not on offer. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse, and a signed deploy manifest is verified by Guardian. Ed25519 audit-signing keys can sit in your KMS or HSM. HMAC tokenization keys live in your environment today, not in a KMS. | SaaS, now on ServiceNow's platform. On-premise collectors gather metadata, but the catalog itself is hosted. We found no self-hosted edition. | ◆ |
| Maturity and reach | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. We are small. | Founded 2016, roughly $350M valuation at the 2022 Series C, acquired by ServiceNow in May 2025, and now sold by one of the largest enterprise sales forces on earth. Public-sector credentials include an AFWERX SBIR and Tradewinds "Awardable" status. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Quote only, and always has been. A free community tier exists. Expect the paid side to migrate toward ServiceNow platform pricing. | ◆ |
◆ DataShield leads◇ data.world leads◈ comparable
data.world claims are drawn from data.world, docs.data.world, the data.world press room and ServiceNow newsroom releases, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from an enterprise catalog
A catalog that never leaves the building
Metadata about regulated data is regulated data. Column names, glossary terms and sensitivity labels tell an attacker exactly where to dig. Ours runs on your own hardware, with your keys, and it works with no outbound call. How it is put together.
Authority that can change mid-flight
An analyst resigns at 4pm on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A catalog would have logged the whole run and told you on Monday. How Auth does it.
Proof that survives an audit
A log you can quietly edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Where data.world is genuinely stronger
Start with the graph. data.world bet on a knowledge graph in 2016, well before it was fashionable, and they stuck with it. That bet paid off in search quality and in how well the glossary holds together across a big estate. Their connector list is long, their on-premise collectors work, and analysts actually enjoy the product, which is rare in this category. The AI Context Engine, launched in March 2024, got to "chat with your data" a year ahead of most catalogs. Their MCP server is real, documented and sensibly built: browser consent, a scoped token, and the AI client never sees your password. And now ServiceNow sells it. If your estate is sprawling and your buyer is the CDO, that combination is hard to argue with, and we would not try.
Here is the push-back. ServiceNow's own May 2026 launch states the problem plainly: AI agents connect to data sources "with no central oversight, no approval workflow, and no audit trail." Their answer is a registry and a gateway, inside ServiceNow, governing agents that ServiceNow also supplies. That is a reasonable answer for a ServiceNow shop. It is a poor answer if you want independent evidence, or if the agent you need to govern was not bought from them. There is also the quieter issue. data.world has issued no press release of its own since the acquisition, and ServiceNow's 2026 materials do not use the name at all. Brands get absorbed. Ask what your renewal looks like in three years, and ask whether the catalog you are buying will still be sold on its own.
Questions worth asking both of us
These are the questions we would want answered if we were buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are signed with Ed25519 and chained to each other, so deleting a checkpoint shows up too. Verification returns clean, attested damage, or tampered, and it tells deletion apart from truncation. Try it at /verify. data.world: we found governance and activity history, but no tamper-evidence mechanism in their docs. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call, not the next token refresh. data.world's MCP tokens are scoped and expire after 30 days. We could not find a mid-session revocation path. Ask how long a compromised agent keeps working after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the subject's key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. data.world describes governance policy workflows. The mechanism underneath is not published. Ask for the mechanism, not the workflow.
Is DataShield a data.world alternative, or do we need both?
Be honest with yourself about the estate. If you need to catalog forty source systems next quarter, buy theirs. Ours scans and profiles a live PostgreSQL source in place today, and the other provider kinds are declared but not built. Where we replace them is a narrower job: the datasets agents actually touch, where you need classification, tokenization, per-call authorization and evidence in one deployable stack. Plenty of teams will run both, and that is a fine answer.
data.world is a ServiceNow product now. Does that matter?
It depends on what you already own. If ServiceNow runs your service desk, this is a gift: one vendor, one contract, and a catalog wired into Workflow Data Fabric. If it does not, you are buying a catalog whose roadmap now serves someone else's agent platform. Two facts worth weighing. data.world has published no press release of its own since the May 2025 deal. ServiceNow's May 2026 launch talks about "ServiceNow Data Catalog" and never mentions the name data.world.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- data.world's current positioning: "The enterprise data catalog data teams trust in the AI era - now by ServiceNow," with a "4.2x more accurate insights" knowledge-graph claim. — data.world, 13 Sep 2026
- ServiceNow announced its acquisition of data.world on 7 May 2025, two months after buying Moveworks for $2.85B. Terms undisclosed; data.world was valued at about $350M at its 2022 Series C. — TechCrunch, 7 May 2025
- ServiceNow's data launch names "ServiceNow Data Catalog" and "Context Engine" and states that AI agents connect to services, MCP servers and data sources "with no central oversight, no approval workflow, and no audit trail." — ServiceNow newsroom, 6 May 2026
- The data.world MCP server is "fully hosted by data.world" at https://api.data.world/mcp, uses browser-based OAuth consent, issues a scoped token valid for 30 days, and never gives the AI client the user's password or access token. — docs.data.world, 13 Sep 2026
- The AI Context Engine launched in March 2024 and was productised in May 2024 as "Chat with your data." The press room's most recent entry predates the ServiceNow acquisition. — data.world press room, 13 Sep 2026
- data.world pricing is quote-only, with no published tiers for paid enterprise plans. — Capterra vendor listing, 13 Sep 2026
Other head-to-heads
DataShield vs Collibra
Governance at enterprise scale, versus enforcement at the tool call.
CatalogDataShield vs Alation
Search and stewardship, and the evidence layer underneath.
CatalogDataShield vs Atlan
A modern metadata plane, versus a governed data plane for agents.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, then revoke an agent mid-session. Then decide what your catalog still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →