Head-to-head · updated 13 September 2026

DataShield vs Databricks: who governs the agent once it leaves the lakehouse?

Databricks is the biggest name in data, and it earned that. It began as Spark, became the lakehouse, and now sells the Data Intelligence Platform. The homepage no longer leads with the lakehouse at all. It leads with Lakebase, serverless Postgres, under the line "One database for AI, apps and agents." Unity Catalog governs the data. Agent Bricks builds the agents. Genie answers the questions. Over 60% of the Fortune 500 are customers. None of that is in doubt here.

We do not build a lakehouse and we will not pretend to. We are the authorization and evidence layer for agents, and we run on your own hardware with your own keys. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed call is sealed into a hash chain you can check yourself. If your agents only ever touch Databricks, this page is about the last mile. If they reach past it, read the whole thing.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Your agents reach past Databricks. A Postgres box, an S3 drop, a vendor API, a SaaS record. One policy plane and one log for all of it.
An examiner asks you to prove a log was not edited. Ours is a SHA-256 chain with signed checkpoints. Break it in a browser and watch the verifier name the exact failure. Try it.
You need to pull an agent's rights mid-session and have the very next tool call fail closed. How Auth does it.
You want the policy engine, the vault and the audit trail on your own hardware. Databricks runs its control plane in the Databricks account, even when your classic compute runs in yours. See the architecture.

Pick Databricks when

You have real volume. Spark, Delta, Photon, model training at petabyte scale. We do not play here and we will not pretend.
You want the agents built for you. Agent Bricks writes the eval suite, tunes the prompt and picks the model from a task description. AstraZeneca parsed more than 400,000 clinical trial documents in under an hour with it.
You want one vendor and one bill. Unity Catalog needs no separate licence, so governance is a config change rather than a purchase order. Our Unity Catalog page goes deeper.
You want serverless Postgres beside your lake, with branching you can reset like code. Lakebase is a good product and we have nothing like it.

Bottom line: Databricks is where the data lives and where the agents get built. DataShield is where an agent's authority gets checked and where the proof gets kept, on hardware you own. In Databricks shops we expect to run alongside, not instead.

Feature by feature

Competitor cells describe what Databricks' public site and docs say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.

What matters	DataShield	Databricks	Edge
Scale and compute	Ontology is a self-hosted dataset platform: ingest, catalog, analysis, transform, snapshot, lifecycle, watch sources, workflows. DuckDB over Parquet for analytics. It is not an ELT tool, not an orchestrator, and not a lakehouse.	Spark, Delta Lake, Photon, model training and serving, all at a scale we do not attempt. Over 20,000 customers and more than 60% of the Fortune 500.	◇
Catalog and field classification	Providers registered over a live connection, scanned and profiled in place with no row egress. PostgreSQL today, not your whole estate. Classification runs 129 field classes with checksum validators and reproducible verdicts stamped with a config digest, including all 18 HIPAA Safe Harbor identifiers.	One metastore across every workspace, cloud and region, covering tables, files, models, agents and MCP servers. That breadth is real. Field-level PII and PHI classification of this kind is not a claim we found on the Unity Catalog pages.	◈
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns a named verdict and tells tampering from insertion, deletion and truncation. Signing keys can sit in your KMS or HSM. Public demo.	Detailed audit events land in system tables, and inference tables capture full model call payloads. We found no claim anywhere that any of it is hash-chained, signed, or verifiable by someone outside the platform.	◆
Agent authorization	Every governed tool call runs a fixed pipeline before dispatch: auth gate, consented-tool narrowing, token scope ceiling, declared authority tier, revocation re-check, then metering. Delegation is RFC 8693 token exchange with an enforced scope ceiling.	Grants and attribute-based policies on catalog objects, plus Unity AI Gateway policy over agents, models and MCP servers, with on-behalf-of execution. Evaluated when a query or call runs, not re-derived as a per-call ceiling.	◆
Break-glass	Scoped, time-boxed emergency access for agents. Admin plus IP allowlist plus step-up, auto-revoking, and it cannot be quietly deleted from the log.	Not described in the docs we read. Ask them.	◆
GDPR erasure	Crypto-shred of the subject's key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the evidence still verifies after the subject is gone.	Delete the rows. What erasure does to audit history, inference tables, or data already copied out of governed tables is not documented.	◆
Tokenization and data handling	Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic, join-preserving and vault-reversible, and every lookup is audited or refused.	Masking and redaction applied at query time by policy, plus gateway guardrails on model traffic. We found no vault-reversible token architecture with a governed detokenization path.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and per-call metering is attributed to the agent that made the call.	Managed MCP servers for Genie, AI Search, Databricks SQL, Unity Catalog functions and a code interpreter. External MCP servers can be registered as catalog securables, and you can host your own as a Databricks app.	◈
Building and tuning agents	We govern agents. We do not build them for you. No eval harness, no fine-tuning, no model serving.	Agent Bricks generates eval suites and auto-tunes prompts, models and reward models from a task description. Mosaic AI sits underneath. This is a real product gap on our side, covered on our Mosaic AI page.	◇
Data quality	A 20-section profile per dataset and a weighted trust score per entity type, domain and estate, recomputed hourly, plus change and drift detection. No monitors, no alerts, no freshness targets on warehouse tables.	Lakehouse Monitoring watches tables and model endpoints with metric tables and dashboards. Different job, and mostly a better fit than ours for pipeline health. Side by side.	◇
Reach beyond the platform	Platform-agnostic by construction. Auth issues the token, the governed surfaces check it on every call, and nothing here requires a particular compute vendor.	Federation reaches out to external sources read-only, with access controls at the table level. Row and column policy stays a Databricks-object story, and your agents do not stop at that line.	◆
Deployment and hosting	Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. No vendor control plane in the loop.	The docs are clear: the control plane "is located in the Databricks account, not your cloud account." Classic compute runs in yours. Serverless compute runs in theirs. Worth knowing which of your workloads is which.	◆
Maturity and pricing	Live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. Published pricing and an instant quote with no call.	A very large company with a deep bench and a long compliance record. Pricing is pay-as-you-go in DBUs, billed per second, with no rate card on the pricing page and cloud compute billed separately underneath. You will need a finance person.	◇

◆ DataShield leads◇ Databricks leads◈ comparable

Databricks claims are drawn from databricks.com and docs.databricks.com, last checked 13 September 2026. We link them below rather than paraphrase from memory.

Three things you get here that you won't get from a data platform

A witness that isn't the defendant

Databricks writes the audit record, stores it in its own tables, and holds the keys to the storage. The telemetry is excellent. It is still the system under review acting as its only witness, and in any other part of the business we would call that a control weakness. Our chain sits in a separate plane with its own signing keys. Edit a record in your browser and the verifier names the exact failure. Try it, no signup.

Authority that can change mid-flight

An analyst resigns on a Friday afternoon. Their agent is forty minutes into a job. With DataShield the next governed tool call re-checks authority and fails closed. A grant change in a catalog does not reach into work that is already running. How Auth does it.

No vendor in your control plane

Databricks says plainly that its control plane runs in the Databricks account. For most buyers that is fine. For a bank with a residency rule, or a health system that wants the evidence plane inside the building, it is the whole conversation. We ship Docker images and a signed deploy manifest. You run all of it. How we deploy.

Where Databricks is genuinely stronger

Nearly everywhere that involves moving or modelling data at scale. Spark and Delta are the default answer for a reason, Photon is fast, and the training stack has customers with real results behind it. Agent Bricks is the part I would not underrate: describe a task, get a generated eval suite and a tuned agent, and skip a month of prompt fiddling. AstraZeneca's 400,000 clinical trial documents in under an hour is a vendor-reported number, but it is the right kind of number. Lakebase is a smart land grab too. Put serverless Postgres with branching next to the lake and agents get a place to write, not just read. Unity Catalog comes with the tiers you already pay for, so governance arrives as a checkbox. Against that, a second vendor has to justify itself in one sentence, which is fair.

Here is our sentence, and it is narrow on purpose. Databricks is the platform that runs the agent, stores the data, writes the log and keeps the log. Four roles, one party. That is fine until the day it matters, and the day it matters is the day someone disputes the record. The rest of the gap follows from the same shape: federation out to other systems is read-only with table-level controls, agent authority is checked when a call runs rather than re-derived as a ceiling per call, and nobody at Databricks is signing anything. We are not asking you to replace any of it. We are asking where the proof lives, and whether the party holding it has an interest in the answer.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion from truncation from tampering. Try it at /verify. Databricks: audit events are rich, queryable and land in system tables, and inference tables hold the full payload of model calls. We went looking for an integrity claim and found none. Ask them to show you the proof, not the query. Our longer argument is in the Unity Catalog write-up.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so a revocation bites on the very next call. Databricks evaluates grants and gateway policy when a call runs, which covers a lot of ground. We found no description of a running agent session being downgraded in flight, and no authority tiers for agents. Ask how long a compromised agent keeps working after you pull its access. We wrote up the token side of this for Databricks MCP servers.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the subject's key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the chain still verifies after the subject is erased. Deleting rows on Databricks is easy. What the docs do not cover is what erasure does to your audit history, your inference tables, or data already copied out. Ask both of us.

Is DataShield a Databricks alternative?

For the lakehouse job, no, and anyone who tells you otherwise is selling. We have no Spark, no Photon, no model serving, and our in-place catalog scanning covers PostgreSQL today rather than your whole estate. What we do replace is the assumption that the platform's own tables are sufficient evidence, and the assumption that governance can stop at the platform edge. Most Databricks customers who talk to us keep everything they have and add a layer.

Our compute runs in our own cloud account. Doesn't that make Databricks self-hosted?

Not quite, and the docs are honest about it. Classic compute runs in your account. The control plane runs in the Databricks account, and serverless compute runs in a Databricks-managed plane too. So ask which of your workloads are serverless, and where Unity Catalog metadata lives. Our answer is simpler: you run every component, we hold no keys, and Guardian verifies the deploy manifest signature before anything starts. Architecture.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. Databricks will hand you a SOC 2 Type II report and ISO certificates through an account team, and that gap is real. Auth is live in production with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been running since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.

Homepage hero, verbatim: "One database for AI, apps and agents," with the sub-head "Lakebase is serverless Postgres for applications that scale." Scale claims on the same page: "Over 60% of the Fortune 500 uses Databricks" and "Over 20,000 customers across the globe." — databricks.com, 13 Sep 2026
Pricing is pay-as-you-go with "no up-front costs. Only pay for the products you use at per second granularity." A DBU is "a normalized unit of processing power on the Databricks Lakehouse Platform." No dollar rate card and no named platform tiers appear on the page. — databricks.com, 13 Sep 2026
Docs, verbatim: "The control plane includes the backend services that Databricks manages in your Databricks account. The control plane is located in the Databricks account, not your cloud account." Serverless compute also runs inside the Databricks account. — docs.databricks.com, 13 Sep 2026
Unity Catalog hero, verbatim: "Unified governance for data, apps and AI agents." Licensing, verbatim: "No separate license is required. Unity Catalog is included with Databricks Premium and Enterprise tiers." — databricks.com, 13 Sep 2026
Agent Bricks launch post, 11 June 2025, reports customer results including AstraZeneca parsing "more than 400,000 clinical trial documents" in "just under 60 minutes," and Flo Health doubling medical accuracy over standard commercial models. — Databricks blog, 11 Jun 2025
Managed MCP servers give agents "governed access to Genie, AI Search, Databricks SQL, Unity Catalog functions, and the code interpreter," with external MCP servers registered as Unity Catalog securables and governed through Unity Gateway. — docs.databricks.com, 13 Sep 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →