Head-to-head · updated 13 September 2026

DataShield vs dbt: the models are tested, but who authorized the agent that read them?

dbt invented analytics engineering and it still owns the workflow. SQL models in git, tests that run in CI, a DAG you can read, and a semantic layer that defines a metric once so two dashboards stop arguing. dbt Core is free and the new Fusion engine shipped as dbt Core v2.0 under Apache 2.0 when the Fivetran merger closed on 1 June 2026. The combined company now says it serves more than 100,000 data teams. If you build tables for a living, you already run dbt, and you should.

We are not a transformation tool. DataShield governs the datasets agents read. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Fields get classified against 129 PII, PHI, financial and secret classes. Every governed tool call is re-checked against the agent's current authority before it runs, and the decision is sealed into a hash chain anyone can verify. Below is the honest split, rows dbt wins included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove an agent's access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh. The next call.
The question is what is in the column, not how it was built. We classify fields against 129 PII, PHI, financial and secret classes, then tokenize or generalize what matters. See the catalog.
The vault, the policy decisions and the evidence all have to run on your own hardware, on keys you hold.

Pick dbt when

You need to build and test tables. That is the whole job dbt was made for, and nothing we ship replaces a dbt project.
You want one definition of revenue. The semantic layer, powered by MetricFlow, hands every dashboard and copilot the same number. We do not define metrics.
Your team wants the workflow: version control, CI, docs, a DAG, and an ecosystem of packages and adapters for every warehouse you own.
You like the new engine. Fusion is Rust, it reads SQL natively, and it catches errors before they hit the warehouse. That is real engineering and it is free.

Bottom line: dbt decides what the table means. DataShield decides which agent may read it and keeps proof of what happened. Almost every team that talks to us already runs dbt, and we have never once asked one to stop.

Feature by feature

Competitor cells describe what dbt's public site, docs and press releases say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What matters	DataShield	dbt	Edge
SQL transformation and testing	Ontology transforms datasets as one capability among ingest, catalog, profiling, snapshot and lifecycle. It is not a modelling framework. There is no Jinja, no adapter ecosystem, no CI story for your models.	The reason the category exists. Models in git, schema and data tests, docs, a DAG, incremental builds, and the Fusion engine reading SQL natively in Rust with static analysis before anything reaches the warehouse.	◇
Semantic layer and metrics	We materialize a business glossary from entity types, using ISO/IEC 11179 data-element concepts. That is vocabulary, not metric logic. We do not compute your revenue definition.	MetricFlow. Define a metric once in YAML, serve it to BI tools, apps and agents. Advanced semantic layer features sit at Enterprise and above.	◇
Sensitive data classification	129 field classes covering PII, PHI, financial data and secrets, deterministic and reproducible, with all 18 HIPAA Safe Harbor identifiers carrying a regulation reference. We scan and profile a live PostgreSQL source in place, with no rows leaving it. That is PostgreSQL today, not your whole estate.	Out of scope. Their security page says plainly that "Data remains in your data warehouse, we don't upload or download it." Whether a column holds patient data is yours to know and yours to handle in SQL.	◆
Tokenization and masking	Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Features you switch on, not defaults.	Not a product feature. You can hash or mask in a model, and plenty of teams do, but the key handling, the reversal path and the audit around it are all homework.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the failure: tampering, insertion, deletion or truncation. Try the verifier.	Job and query logs, run artifacts, and an admin API. Useful for debugging a build. We found no tamper-evident record of which agent read which table.	◆
Agent authorization	Every governed tool call passes a consented-tool allowlist, a scope ceiling, a declared authority tier and a mid-session revocation re-check before dispatch. It fails closed.	The MCP server authenticates with OAuth or a token and serves models, metrics, lineage and freshness. Their docs describe governed access as consistency of context. We found no per-call authorization decision.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes, and it cannot be quietly removed from the log.	Not described in their public material.	◆
GDPR erasure	Crypto-shred of per-subject key material, cited to ISO/IEC 27040 and GDPR Article 17, plus ISO 27560 consent receipts. The audit chain still verifies afterwards.	They hold job metadata rather than your rows, so there is less to erase on their side. A subject-level erasure mechanism is not documented, because deleting the person is a job for whatever holds the data.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, meters each call, attributes it to the agent, and seals an audit row. Delegation is RFC 8693 token exchange with an enforced scope ceiling.	A real MCP server in two flavours, self-hosted and remote, covering CLI commands, the Semantic Layer, SQL execution, metadata discovery and the admin API. Plus Agents Schema, an open standard that points agents at one shared context schema in your warehouse.	◆
Catalog and lineage	Asset and column metadata, a materialized glossary, typed lineage traversal with per-hop access gating, and a 29-command stewardship workflow. Lineage is derived from the pipelines that own it, not a stored graph.	dbt Catalog plus lineage built from the DAG you already wrote, which is the cheapest accurate lineage anyone has shipped. Advanced Catalog is Enterprise and up.	◇
Deployment	Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse, and a signed deploy manifest is verified by Guardian. Ed25519 audit-signing keys can live in your KMS or HSM; HMAC tokenization keys sit in your environment today, not in a KMS.	dbt Core runs anywhere you can run a CLI, which is a genuinely free self-hosted path. The platform is SaaS. PrivateLink, IP restrictions and hybrid projects appear only at Enterprise+.	◈
Open source	Not open source. You get Docker images, a signed deploy manifest, and source escrow in design-partner terms.	dbt Core is free, and Fusion shipped as dbt Core v2.0 under Apache 2.0 at the merger close. That is a real commitment, kept in public, after an acquisition that made people nervous.	◇
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	Founded 2016, category creator, merged with Fivetran on 1 June 2026 into a company that claims more than 100,000 data teams. Their security page cites ISO 27001, ISO 27701 and ISO 42001 as guiding standards.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Developer is free. Starter is $100 per user per month with 15,000 models and 5,000 queried metrics. Enterprise and Enterprise+ are quote only, and that is where the catalog, semantic layer, Mesh and the network controls live.	◈

◆ DataShield leads◇ dbt leads◈ comparable

dbt claims are drawn from getdbt.com, docs.getdbt.com and Fivetran press releases, last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from a transformation tool

Proof that survives an audit

A log you can silently edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier names what broke, not just that something did. It even tells damage you already attested to apart from fresh tampering. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst hands in her notice on a Friday. Her agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. Your dbt tests stay green the whole time, because the tables are fine. The tables were never the problem. How Auth does it.

A view of what is actually in the column

"Data stays in your warehouse" is a fine answer to a security review. It is no answer at all when someone asks whether an agent read PHI last Tuesday. We classify fields against 129 classes, mark the 18 HIPAA Safe Harbor ones with a regulation reference, and can tokenize or generalize them before an agent sees a row. See the classification story.

Where dbt is genuinely stronger

Let's be fair. dbt changed how data teams work, and the change stuck. Version control, tests, CI and code review were normal in software and rare in analytics until dbt made them the default. The free Core tier is not a crippled trial, it is the actual tool. The Fusion engine is a serious piece of engineering: Rust, native SQL comprehension, static analysis that catches a broken reference before your warehouse bills you for it. And when the Fivetran merger closed on 1 June 2026 they open sourced Fusion as dbt Core v2.0 under Apache 2.0, which is the opposite of what most people feared. Tristan Handy kept the community brief and the licence promise was kept in public. The semantic layer is the right idea too. One metric definition, served everywhere, is worth more to an AI project than another dashboard.

Here is the push-back. Agents Schema is a bet that agent trust is a context problem: put the right shared schema in the warehouse and agents will behave. Context is necessary and it is not sufficient. A perfectly defined metric tells you nothing about whether this agent, this minute, is allowed to see the rows behind it. The dbt MCP server can run SQL, and the docs describe governed access as consistent access to models, metrics, lineage and freshness. That is consistency, not authorization. There is no per-call decision point we could find, no mid-session revocation, and no evidence artifact an examiner could check independently. One more thing worth naming. Fivetran took stewardship of Great Expectations on 13 May 2026, then closed the dbt merger three weeks later. One company now owns your ingestion, your transformation and the best known open source data quality project. That is not a reason to drop dbt. It is a good reason to keep your evidence layer somewhere else.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained to each other. Verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. dbt: their platform keeps job logs, query logs and run artifacts, which are built for debugging builds. We found no tamper-evident access record. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call rather than the next token refresh. The dbt MCP server uses OAuth or token auth and can execute SQL. Their public docs do not describe session revocation or a per-call scope check. Ask how long a pulled credential keeps working, and ask it about the remote server specifically.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material, which destroys every ciphertext for that subject at once, and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. dbt holds metadata rather than rows, so the erasure question lands on your warehouse instead. Ask what is in the job and query logs, and who can read them.

Is DataShield a dbt alternative? Do we stop running dbt?

No, and no. We do not model your warehouse. There is no Jinja, no adapters, no CI workflow for your SQL, and we are not going to build one. Keep dbt. Run us for the governed datasets agents read, where the job is classification, authorization and evidence. The two tools meet at one place only: the MCP surface an agent calls.

dbt ships an MCP server and Agents Schema. What's different about yours?

Theirs gives an agent context: models, metrics, lineage, freshness, and a shared schema in your warehouse to read from. That is a good design for a transformation platform. Ours is where the governed data itself is queried. The tool token carries a scope ceiling, the call is authorized and metered before dispatch, and the decision is sealed into the chain. Ask an agent what revenue means using theirs. Let an agent read a patient table using ours.

The Fivetran merger closed. Does that change anything for us?

For dbt users, mostly in a good way so far. Fusion went Apache 2.0, the licence promise held, and ingestion and transformation now come from one vendor. The thing to watch is concentration. That company also stewards Great Expectations, so your pipeline, your models and your quality checks share one roadmap owner. Ask them where agent authorization sits in that roadmap, and who owns it.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. dbt's own security page cites ISO 27001, ISO 27701 and ISO 42001 as standards guiding their program, and you should ask them directly what they hold rather than what guides them. What we offer is a public threat model and a verifier anyone can run. Design partner terms include source escrow, so a small vendor is not a single point of failure. Auth, Guardian and Lighthouse are live in production, Guardian and Lighthouse since April 2026. Details on the security page.

Fivetran and dbt Labs completed their merger on 1 June 2026, with the Fusion engine runtime "released as dbt Core v2.0 under an Apache 2.0 license" and the combined company serving "more than 100,000 data teams globally." — Fivetran press release, 1 Jun 2026
Agents Schema is described as "an open source standard for agentic context" that "designates a single schema in the warehouse or lake as the shared context layer for AI agents." — Fivetran press release, 1 Jun 2026
The dbt MCP server "ensures consistent, governed access to models, metrics, lineage, and freshness across your AI tools," ships self-hosted and remote, and provides SQL execution and the Semantic Layer. — docs.getdbt.com, 13 Sep 2026
dbt Labs on customer data: "Data remains in your data warehouse, we don't upload or download it," with ISO 27001, ISO 27701 and ISO 42001 cited as standards guiding the security program. — getdbt.com/security, 13 Sep 2026
Merger announcement: combined ARR of roughly $600M, and a commitment that "dbt Core and Fusion will both continue to be shipped under their current licenses." — dbt Labs blog, 13 Oct 2025
Published pricing: Developer free with 3,000 models per month; Starter $100 per user per month with 15,000 models and 5,000 queried metrics; Catalog, Semantic Layer, Copilot, Canvas, Insights and Mesh at Enterprise and above. — getdbt.com/pricing, 13 Sep 2026
Fivetran became steward of the Great Expectations open source community and the GX Core project three weeks before the dbt merger closed. — Fivetran press release, 13 May 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →