Head-to-head · updated 13 September 2026

DataShield vs Elementary: the dbt tests are green, so who let the agent read the table?

Elementary is the dbt-native data observability tool that people actually keep. It started as an Apache-2.0 dbt package and it still is one. Any dbt shop can add volume, freshness and schema tests in an afternoon, with no new servers. The Cloud adds automated monitors on every production table, column level lineage into the BI dashboard, incident grouping and health scores. It also ships a real MCP server your agents can call. Their September 2026 post asks a good question: can an agent trust this data, for this query, right now?

We answer the other half of that sentence. DataShield does not watch your pipelines, and we have no monitors, no freshness SLAs and no pager. We govern the datasets agents read. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority before it runs. The decision is then sealed into a hash chain anyone can verify. Below is the honest split, rows Elementary wins included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove an agent's access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
The question on the table is what is in the data, not whether it arrived on time. We classify fields against 129 PII, PHI, financial and secret classes, then tokenize and mask what matters. See the catalog.
Everything has to run on your own hardware, agents and MCP server included, on keys you hold.

Pick Elementary when

You run dbt and want value this week. The package drops into your project, config lives in YAML next to your models, and the tests run where your models run.
The pain is silent pipeline failure. A table stopped refreshing on Saturday and nobody noticed until Tuesday. That is their home ground and they are good at it.
You want column-level lineage from source to dashboard, plus incident grouping that cuts alert noise. We ship typed lineage edges, not a BI-to-source graph.
You need SOC 2 Type II on the vendor today. They have it. We do not, and we say so.

Bottom line: Elementary tells you whether the table is healthy. DataShield decides whether the agent may read it and keeps proof of what happened. Most dbt shops that talk to us already run Elementary, and we would not ask them to stop.

Feature by feature

Competitor cells describe what Elementary's public site, docs and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What matters	DataShield	Elementary	Edge
Pipeline monitoring and anomaly detection	None. We have no monitors on warehouse tables, no freshness SLAs, no alerting and no anomaly detection. We will not pretend otherwise.	The core product. Volume, freshness, schema and column-metric anomaly tests in the OSS package, plus no-setup automated monitors across every production table in Cloud, with training periods up to three months.	◇
Dataset profiling and trust scoring	Every dataset gets a 20-section analysis profile: completeness, field statistics, patterns, column semantics, relationship graph, quality metrics, transformation lineage, business rules, source fingerprint. A weighted composite trust KPI rolls up per entity type, domain and estate, with per-axis breakdown and trend, recomputed hourly.	Data Health Scores built from test and monitor outcomes, plus coverage reporting. Scored on whether checks pass, not on what the data looks like.	◆
Sensitive data classification	129 field classes covering PII, PHI, financial data and secrets, deterministic and reproducible, with 18 HIPAA Safe Harbor classes carrying a regulation reference. We scan and profile a live PostgreSQL source in place with no rows leaving it. That is PostgreSQL today, not your whole estate.	Out of scope by design. Their docs say plainly that Cloud "does not have read access to raw data in your data warehouse" and stores only metadata, logs and aggregated metrics. Good for a security review, useless for the PHI question.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the failure: tampering, insertion, deletion or truncation. Try the verifier.	SOC 2 Type II and HIPAA claims for their own service, with audit reports available on request to legal@elementary-data.com. That is assurance about Elementary, not an evidence artefact about your agents.	◆
Agent authorization	Every governed tool call passes a consented-tool allowlist, a scope ceiling, a declared authority tier and a mid-session revocation re-check before dispatch. It fails closed.	The MCP server is described as "a single authenticated endpoint" for models, tests, incidents, lineage and execution history, plus test authoring. We found no per-call authorization model in their public docs.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes, and it cannot be quietly removed from the log.	Not described in their public material.	◆
GDPR erasure	Crypto-shred of per-subject key material, cited to ISO/IEC 27040 and GDPR Article 17, plus ISO 27560 consent receipts. The audit chain still verifies afterwards.	A DPA, EU-default residency in Frankfurt, and metadata-only storage so there is less to erase. No subject-level erasure mechanism is documented.	◆
Tokenization and masking	Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Features you switch on, not defaults.	Not part of the product. Failed-row samples are the only row data they touch, and you can turn those off with test_sample_row_count: 0.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, meters each call, attributes it to the agent, and seals an audit row. Delegation is RFC 8693 token exchange with an enforced scope ceiling.	A real remote MCP server since July 2025, and named agents for test recommendations, triage, governance, catalog and cost, now merged into one orchestrating agent. It serves metadata and can author tests. Cloud only, and the AI Layer is priced separately on credits.	◆
dbt-native workflow	We are not a dbt tool. Ontology ingests, catalogs, profiles, transforms and snapshots datasets on its own, which is a different shape of work.	Genuinely excellent. Config as code in dbt YAML, artifacts persisted into your own warehouse schema, lineage derived from dbt itself, nothing extra to run.	◇
Deployment	Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse, and a signed deploy manifest is verified by Guardian. Ed25519 audit-signing keys can live in your KMS or HSM; HMAC tokenization keys sit in your environment today, not in a KMS.	Cloud is SaaS on AWS, EU Frankfurt by default with a US option. The free OSS edition is self-hosted, but it is a dbt package and a static HTML report: the agents, MCP server, catalog, incidents and health scores are all Cloud. "Advanced Deployment Options" appear at Enterprise with no public documentation.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	Repo created August 2021, 2,406 stars, Cloud GA April 2024, SOC 2 Type II, HIPAA claim, AWS Marketplace, a Gartner Representative Vendor listing, and a logo wall with Elastic, Klarna, IKEA and Zoom on it.	◇
Pricing	Published model, scoped instant quote, no sales wall. A free self-hostable path exists.	Apache-2.0 OSS is free forever. Cloud is three quote-only tiers priced on editor and viewer seats plus monitored tables, with a per-1K-table overage and a credit-priced AI Layer add-on. No dollar figures published anywhere.	◈

◆ DataShield leads◇ Elementary leads◈ comparable

Elementary claims are drawn from elementary-data.com, docs.elementary-data.com and their blog, last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from a data observability tool

Proof that survives an audit

A log you can silently edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. It even distinguishes damage you already attested to from fresh tampering. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst hands in her notice on a Friday. Her agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. An observability tool will show you a healthy table the whole time, because the table is healthy. How Auth does it.

A view of what is actually in the column

Metadata-only is a lovely security story right up to the moment someone asks whether an agent read PHI. We classify fields against 129 classes and mark the 18 HIPAA Safe Harbor ones with a regulation reference. We can generalize or tokenize them before an agent sees a row. See the classification story.

Where Elementary is genuinely stronger

Let's be fair about this. Elementary solved a problem we do not touch. If a model stops running, a source stops refreshing, or a column fills up with nulls, they catch it and route the alert. Their customers say the alerts are mostly real, not noise. The OSS package is good engineering. Config lives in dbt YAML, results land in your own warehouse schema, and lineage comes from artifacts you already produce. Their Cloud adds column level lineage that reaches the BI dashboard, incident grouping, cost insights and a working MCP server. That is more shipped agent surface than most of this market can show. They hold SOC 2 Type II and claim HIPAA compliance. In April 2026 their CI pipeline was compromised and a malicious Python CLI reached PyPI. They published a full incident report, gave people a marker file to check, and told them to assume their credentials were exposed. That is how it should be done, and plenty of larger vendors would have buried it.

Here is the push-back, and it is structural rather than a feature gap. Their architecture is built on never reading your rows, which makes the security review easy and makes the sensitive-data question permanently unanswerable. A Data Health Score tells you the table passed its tests. It cannot tell you the table holds 40,000 patient records. It cannot tell you the agent that read it was revoked an hour ago, or that the log saying so is unedited. There is also a shape of risk worth naming. Fivetran and dbt Labs closed their merger on 1 June 2026. Three weeks before that, Fivetran took over Great Expectations. So the company that owns dbt now owns the best known open source data quality project too, and Elementary builds on both. That is not a reason to avoid Elementary. It is a reason to keep your evidence layer somewhere independent.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it. Checkpoints are Ed25519-signed and chained to each other. Verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Elementary: they hold SOC 2 Type II and will send audit reports and pen-test results on request, which speaks to their own controls. We found no tamper-evident record of which agent or user read which asset. Ask them for one.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call rather than the next token refresh. Elementary's MCP server is documented as a single authenticated endpoint serving metadata and test authoring. Their public docs do not describe session revocation or per-call scope. Ask how long a pulled credential keeps working.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material, which destroys every ciphertext for that subject at once, and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Elementary stores metadata rather than rows and defaults to EU residency in Frankfurt, so there is less subject data to erase. We could not find a documented subject-level erasure path. Ask what happens to failed-row samples.

Is DataShield a data observability tool? Do we drop Elementary?

No, and no. We have no monitors, no freshness SLAs, no anomaly detection and no incident management. If your problem is a pipeline that fails quietly, buy an observability tool and buy a good one. Run us for the datasets agents read, where the obligation is classification, authorization and evidence. Most dbt shops will sensibly run both, and the two tools barely touch.

We already run the Elementary OSS package. Can we self-host everything?

Their OSS edition is a dbt package plus a CLI and a static HTML report, which you self-host completely. The parts most buyers want, agents, MCP server, catalog, incident management and health scores, are Cloud-only SaaS on AWS. "Advanced Deployment Options" show up on the Enterprise tier with no public documentation, so ask them exactly what that means before you assume on-prem. DataShield ships Docker images for Auth, Ontology, Corpus and Lighthouse, and the whole control plane runs inside your perimeter.

Both of you ship MCP servers. What's the difference?

Theirs hands an agent metadata: assets, lineage, incidents, tests, execution history, and it can author new tests. That is a sound design for an observability product. Ours is where the governed data itself is queried. The tool token carries a scope ceiling, the call is authorized and metered before dispatch, and the decision is sealed into the chain. Different jobs. Ask an agent what broke using theirs. Let an agent read a patient table using ours.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. Elementary does hold SOC 2 Type II, and that is a real gap on our side. What we offer instead is a public threat model and a verifier anyone can run. Design partner terms include source escrow, so a small vendor is not a single point of failure. Auth, Guardian and Lighthouse are live in production, Guardian and Lighthouse since April 2026. Details on the security page.

Elementary's current positioning: "Trusted Data for the AI Era. Observability, Quality, Governance, and Discovery under one control plane." — elementary-data.com, 13 Sep 2026
Elementary Cloud "does not have read access to raw data in your data warehouse" and "only extracts and stores metadata, logs and aggregated metrics"; SOC 2 Type II and HIPAA compliant; EU (Frankfurt) default residency. — docs.elementary-data.com, 13 Sep 2026
The Elementary MCP server is exposed via "a single authenticated endpoint" serving asset metadata, table and column-level lineage, incidents, tests, models and execution history. — docs.elementary-data.com, 13 Sep 2026
Elementary 2.0: "a data and AI control plane" with a shared context engine and a network of AI agents covering observability, quality, governance and discovery. — Elementary blog, 1 Dec 2025
Malicious release of the Elementary OSS Python CLI v0.23.3 via GitHub Actions script injection: "Users who installed 0.23.3 ... should assume that any credentials accessible to the environment where it ran may have been exposed." — Elementary blog, 27 Apr 2026
Fivetran and dbt Labs completed their all-stock merger, with dbt Core v2.0 alpha open-sourcing the Fusion engine under Apache 2.0. — Fivetran press release, 1 Jun 2026
Fivetran became steward of the Great Expectations open source community and the GX Core project. — Fivetran press release, 13 May 2026

Other head-to-heads

Observability

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →