Head-to-head · updated 13 September 2026
DataShield vs Elastic: great retrieval, but what actually reaches the model?
Elastic calls itself "The Search AI Company" and the hero line is "Better retrieval. Better answers." They have earned it. One engine does BM25 keyword, dense vectors, their own sparse encoder, and hybrid ranking. It runs over the same index that already holds your logs. Agent Builder is GA, it ships a real MCP server, and Claude Desktop or Cursor can call it today. If retrieval quality at scale is your problem, Elasticsearch is a good answer. We will not pretend otherwise.
We are not a search engine. DataShield is the governance layer under the retrieval. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings are computed locally with nomic-embed-text, so nothing leaves to be vectorized. Every governed tool call is re-checked against the agent's current authority before it runs. The decision is then sealed into a hash chain you can verify without trusting us. Here is the honest split, including the rows Elastic wins outright.
The short version
Pick DataShield when
- The PII must be gone before the prompt is built, not filtered out after retrieval. Tokens go in at ingest, and a fail-closed gate redacts any PII column with no configured treatment.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next key rotation. The next call.
- Embeddings must be computed inside your walls. Ours run locally on
nomic-embed-text, with no vectorization call leaving the box.
Pick Elastic when
- Retrieval quality across a big, messy estate is the actual problem. Keyword, dense vector, sparse vector and hybrid ranking in one engine is a real advantage, and ours is narrower.
- You already run Elasticsearch for logs or security. Adding an agent over an index you have tuned for years beats standing up a second data plane.
- You want 300+ integrations and 60 cloud regions from a public company with a support SLA. We are a small team and we say so.
- Your search workload needs the engineering Elastic has put into vector performance, including Better Binary Quantization on by default since 9.1.
Bottom line: Elastic decides what is relevant. DataShield decides what the agent may do with it, keeps raw values out of the prompt, and keeps proof of the decision. Most buyers who talk to us keep their index and add the layer underneath.
Feature by feature
Competitor cells describe what Elastic's docs, pricing pages and press releases say as of the date above. If we got something wrong, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Elastic | Edge |
|---|---|---|---|
| Retrieval engine | Hybrid retrieval on Postgres: a tsvector keyword leg and a pgvector leg, 768-dimension vectors, per-corpus chunk tables built at index time. Good for governed datasets. Not a search platform for your whole estate. | The strongest row on this page for them. BM25, dense kNN, their learned sparse encoder, and Reciprocal Rank Fusion hybrid ranking in one engine, with Better Binary Quantization on by default since 9.1. | ◇ |
| Embeddings | nomic-embed-text runs locally in your deployment. No embedding call leaves the network, which matters when the text being vectorized is clinical notes. | Elastic Inference Service and third-party model providers, billed per million tokens. Their own encoder can run in-cluster on paid ML nodes. Vectorizing through a hosted service is the default path. | ◆ |
| Data handling before the model | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. We do not proxy your LLM traffic. We do gate every value that leaves a governed dataset for a prompt, and a PHI dataset refuses an endpoint without a BAA. | Document- and field-level security filters what a role may read at query time. Values that pass the filter reach the prompt as written. Tokenization is not vocabulary Elastic uses. | ◆ |
| Permission-aware retrieval | Authorization is a per-call decision on the agent's live context, not a query filter baked into a role. Chunk views also mask at read time and rebuild the keyword index from the masked text, so search cannot be used to probe for a redacted value. | Real and widely used, but it is Elasticsearch roles and API keys. Their own DLS docs concede that users "can still craft searches revealing aggregate data, field names, and term counts from inaccessible documents." That is an inference channel, in writing, from the vendor. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier, and a mid-session revocation re-check before dispatch. It fails closed. | Agent Builder docs say to "configure security roles and API keys to control who can use agents, which tools they can access, and what data they can query." That is configuration at setup time. We found no per-call re-check. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns one of three verdicts: clean, attested damage, or tampered, and names the row that broke. Try it on a sample chain. | Elasticsearch has audit logging and Kibana has an activity view. We found no published tamper-evidence mechanism and nothing about audit logging in the Agent Builder docs. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes, it is IP-allowlisted and step-up gated, and it cannot be quietly removed from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred: delete the subject key and every ciphertext for that subject goes unreadable at once. ISO 27560 consent receipts, signed at grant and at withdrawal. The audit chain still verifies afterwards. | Delete by query, index lifecycle policies, and reindexing. Nothing published about what erasure does to an embedding already computed from the deleted text. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with enforced scope ceilings and meters every call against the agent that made it. Ontology's MCP surface authenticates with tiered API keys, and we would rather say that than imply otherwise. | Agent Builder GA with a built-in MCP server, external clients like Claude Desktop and Cursor supported, external MCP tools importable, plus an A2A server. Shipped and priced, not a roadmap slide. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment or derive from your machine key today, not in a KMS. | Elastic Cloud Hosted, Elastic Cloud Serverless, and fully self-managed on-prem. 60 regions across four clouds. Hard to beat and we do not claim to. | ◈ |
| Pricing | Published model and a scoped instant quote with no sales wall. Entitlements are enforced in code: tool access is gated by tier at dispatch and per-call usage is metered per agent. | Unusually open for an enterprise vendor. Serverless lists ingest from $0.14 per VCU-hour, search from $0.09, storage from $0.047 per GB per month, and Agent Builder at $0.025 per execution after 1,000 free. Agent tool calls become a metered line item, which is worth modelling before you build a chatty agent. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so on the page rather than in a footnote. | Public company since 2018, an OpenAI partnership in July 2026, the Deductive AI acquisition in August 2026, and a customer list that includes PepsiCo, IBM and Comcast. | ◇ |
◆ DataShield leads◇ Elastic leads◈ comparable
Elastic claims are drawn from elastic.co product docs, the Serverless pricing page, the subscriptions page and Elastic's investor-relations press releases, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a search platform
The PII is gone before the prompt exists
A retrieval filter decides which documents a role may read. It runs after the values are already in the index, in the clear. We tokenize at ingest instead. Every value crossing into a prompt passes a fail-closed gate: a PII column with no configured treatment gets redacted, and a PHI dataset refuses an AI endpoint not marked BAA or ZDR approved. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute retrieval job. With DataShield the next governed tool call is re-checked against current authority and fails closed. An API key configured last quarter keeps working until someone remembers to delete it. How Auth does it.
Proof, not a log file
Any log can be edited by whoever owns the cluster. Ours is a hash chain with signed, chained checkpoints. The verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
Where Elastic is genuinely stronger
Retrieval is their craft and it shows. One engine covers keyword, dense vector, sparse vector and hybrid ranking. Better Binary Quantization landed on by default in 9.1, with a claimed 5x speed-up over OpenSearch and a large memory saving. ES|QL now has joins and cross-cluster search. Their 2026 writing on context engineering is the best public thinking we have read on why retrieval still beats a bigger context window. We say that as a competitor. Add 300+ integrations, 60 regions, a GA MCP server, open pricing, and an OpenAI partnership, and you have distribution we will not match. If your question is "which engine finds the right chunk," ask them, not us.
Here is the push-back. Their July 2026 language is "permission-aware retrieval," and the mechanism underneath it is Elasticsearch roles with query templates. That is access control, not data protection. The sensitive values still sit in the index in the clear. And the gap is documented by them, not us: their DLS page says a restricted user can still learn aggregate data, field names and term counts from documents they cannot read. Field- and document-level security also lives in Platinum and Enterprise, and Platinum is closed to new self-managed customers. So ask an Elastic seller three things. Which tier is the safety story in? Does a raw value ever reach a prompt before the filter runs? Who can show you afterwards that it did not?
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained, and verification returns clean, attested damage, or tampered. Re-tamper a chain already marked as damaged and it flips back to tampered on its own. Run it against a sample chain at /verify. Elastic: Elasticsearch writes audit logs and Kibana shows activity. We found no tamper-evidence mechanism in their docs. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call. Revocation lands on the very next call, and the context drops to anonymous. Elastic's Agent Builder controls access with security roles and API keys set up in advance. We could not find a mid-session re-check in their public docs. Ask how long a compromised agent keeps retrieving after you pull its key.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the subject key. Every ciphertext for that subject goes unreadable at once, and we issue an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Elastic gives you delete by query and index lifecycle management. Ask what happens to embeddings already computed from the deleted text. A vector built from a person's notes is still built from that person.
Do we have to rip out Elasticsearch to use DataShield?
No, and most people shouldn't. Keep the index. Our retrieval covers the datasets we govern, not your whole estate: hybrid keyword and vector search over pgvector, ingest from files, URLs and S3-compatible storage, and PDF, DOCX and EML extraction. If the sensitive subset is what agents touch, govern that subset here. Let Elastic serve the rest. The question is where the enforcement and the evidence land, not which engine ranks better.
Elastic ships an MCP server too. What's different?
Theirs exposes Agent Builder tools and Elasticsearch data to external clients. It is a good piece of work. Ours is where the governed data itself is queried. The tool token carries a scope ceiling, the call is authorized and metered before dispatch, and the decision is sealed into the chain. One more difference worth pricing: their Agent Builder runs bill at $0.025 each after the first 1,000. Agent loops are not famous for calling a tool once.
Is our RAG content masked, really?
Partly, and we would rather be precise than flattering. Structured dataset columns are tokenized or generalized. The prompt-egress gate is fail-closed on unconfigured PII. RAG chunk views mask at read time, and the keyword index is rebuilt from masked text, so search can't be used as a probe. But free-text documents you upload are indexed as written, apart from a standing sensitive-pattern filter. Our own tool docs say so. Do not put a document in the corpus whose body text must be masked.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth is live, with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- Elastic positions itself as the context layer for frontier models: agents get "relevant, real-time context with the right permissions," via "Elastic AI Assistants, Agent Builder and MCP integrations." — Elastic investor relations, 30 Jul 2026
- Agent Builder is "an AI conversational platform" over Elasticsearch data, exposes tools through an MCP server to clients like Claude Desktop and Cursor, and controls access with "security roles and API keys." — Elastic product docs, 13 Sep 2026
- Document-level security documented limitation: restricted users "can still craft searches revealing aggregate data, field names, and term counts from inaccessible documents." — Elasticsearch reference docs, 13 Sep 2026
- Field- and document-level security is a Platinum and Enterprise feature; self-managed Platinum is closed to new customers. — elastic.co/subscriptions, 13 Sep 2026
- Serverless pricing: ingest from $0.14 per VCU-hour, search from $0.09, storage from $0.047 per GB per month; Agent Builder 1,000 executions free, then $0.025 per execution. — elastic.co/pricing/serverless-search, 13 Sep 2026
- Better Binary Quantization on by default in Elastic 9.1, claimed "5x faster than OpenSearch," alongside ES|QL joins and cross-cluster search GA. — Elastic blog, 29 Jul 2025
- Elastic's search-labs team argues context engineering has "succeeded prompt engineering as the core discipline for agent quality." — Elastic blog, 18 Aug 2026
Other head-to-heads
DataShield vs Glean
Permission-mirroring search, versus authority checked at the call.
RAGDataShield vs Azure AI Search
A cloud retrieval service, and the evidence layer it doesn't ship.
RAGDataShield vs Vespa
Ranking engineering at scale, versus governed data for agents.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser. Break a live audit chain, revoke an agent mid-session, then ask what your retrieval layer still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →