Head-to-head · updated 13 September 2026
DataShield vs Enkrypt AI: if the gateway unredacts the data, who watched it happen?
Enkrypt AI built the loudest secure-MCP story in the market, and a lot of it is real. Their gateway sits in the request path, strips PII out of tool calls before the MCP server sees them, screens for injection and jailbreaks, and their red-team work has a public leaderboard behind it. Since the Anaconda acquisition they've also started publishing prices, which is more than most of this field does.
DataShield answers a different question. Datasets are tokenized at ingest, agents query tokenized data over MCP, and detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority before it dispatches, and every decision is sealed into a hash chain that anyone with the public verifier can check. Below is where the two actually differ, including the places Enkrypt is simply better.
The short version
Pick DataShield when
- You'll eventually have to prove an agent's access log wasn't edited, to an examiner or under EU AI Act Article 12. A generated compliance report is a claim; a hash chain is a check anyone can run. Run the verifier.
- You need an agent's authority pulled mid-session, with the very next governed tool call failing closed rather than a gateway key riding until someone rotates it.
- Re-identification has to be a deliberate, logged event, not an automatic step at the end of every response.
- Erasing a subject can't be allowed to break your audit trail, and you need the consent receipt to go with it.
Pick Enkrypt AI when
- You want an inline interceptor today. Their proxy modifies, blocks, and approves tool calls in flight. We don't sit inline, deliberately, and we'd rather say so than fudge it.
- You need content-attack detection: prompt injection, jailbreak, toxicity, NSFW, multimodal. We do none of that.
- Red teaming is part of the buy. They run attack simulation as a product and publish a 200-plus model safety leaderboard. We have nothing comparable.
- You want SOC 2 Type 2 in hand and a free Apache-2.0 gateway your engineers can pip install this afternoon.
Bottom line: Enkrypt guards the pipe and screens the traffic. DataShield governs what an agent was allowed to do with the data and keeps evidence of it. Pairing them is a sensible architecture. If you can only fund one and your auditor is the person you're scared of, start here.
Feature by feature
Competitor cells describe what Enkrypt AI's public site, docs, and OSS repo say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Enkrypt AI | Edge |
|---|---|---|---|
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | The open-source gateway writes requests to local log files. Enterprise adds reporting and audit-ready export packages. No published cryptographic tamper evidence. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch, with per-call metering attributed to the agent. | Gateway and API keys plus tool allowlists. We found no authority tiers, delegation model, or mid-session revocation in their public material. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. Shipped in Auth v1.0. | Not offered that we can find. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC commitments, so nothing has to be deleted from the chain. | Redaction is transient and per-request. No published erasure mechanics for the token mappings or the request and response logs. | ◆ |
| PII handling | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus k-anonymity generalization of quasi-identifiers. Detokenization is a privileged, logged operation. | Inline detect, redact, then auto-unredact. The MCP server never sees raw values; the gateway holds the entity-to-token mapping and restores cleartext into the response. | ◈ |
| Content-attack detection | None, by design. Pair us with a detection layer, theirs included. | Injection, jailbreak, toxicity, NSFW, topic and PII detection, multimodal. | ◇ |
| Red teaming | None. | Attack simulation as a product, plus a public LLM safety leaderboard covering 200-plus models. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings issued by the identity plane. | Bidirectional MCP proxy with tool allowlisting, sandbox isolation, and pre and post-execution validation. Plus an MCP scanner for server and tool risk discovery. | ◇ |
| Deployment | Self-hosted, in your VPC, or BYOC, end to end. Your keys. | OSS gateway self-hosts via pip, Docker, or Kubernetes. Guardrails commonly run as their hosted API; unlimited VPC usage appears at the Enterprise tier. | ◈ |
| Compliance reporting | Designed to map to EU AI Act Article 12 and 26 and HIPAA §164.312(b), with evidence you can verify yourself. No packaged report generator. | Compliance Management maps model behaviour to the EU AI Act, NIST AI RMF, HIPAA and ECOA, with audit-ready reasoning traces. | ◇ |
| Maturity signals | Auth v1.0 live. Guardian and Lighthouse v0.2, in production since April 2026. SOC 2 not yet certified, and we say so. | Founded 2022, SOC 2 Type 2, Gartner Cool Vendor in AI Security 2025, and now owned by Anaconda. The OSS gateway itself is a young repo; customers are mostly unnamed. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Published self-serve tiers: free Explore, $149/mo Launch, $1,499/mo Scale on credit metering, then custom Enterprise. One of the few competitors here who post a number. | ◈ |
◆ DataShield leads◇ Enkrypt AI leads◈ comparable
Enkrypt AI claims are drawn from enkryptai.com, their pricing page, their newsroom, and the enkryptai/secure-mcp-gateway repository, last checked 13 September 2026. Links below, so you can read the original rather than our paraphrase.
Three things you get here that you won't get from an MCP gateway
A log the vendor can't quietly fix
A local log file can be edited by anyone who can edit files, which on most hosts is a longer list than the security team thinks. Ours is a hash chain with signed checkpoints, and the verifier says what broke: tampering, insertion, deletion, or truncation. That is the property an EU AI Act Article 12 or HIPAA §164.312(b) reviewer is testing. Run it against a broken chain.
Revocation that beats key rotation
Someone resigns on a Tuesday and their agent keeps grinding through an overnight export. Here, the next governed tool call is re-checked against current authority and fails closed. With a gateway key, the pipe stays open until somebody remembers to rotate it. How Auth does it.
Erasure that reaches the mapping table
GDPR says delete the subject. Your auditor says keep the record. Crypto-shred settles it: the subject's key material is destroyed, the data becomes unreadable, and the chain still verifies. Ask any redaction vendor what happens to their stored mappings. The mechanism, drawn.
Where Enkrypt AI is genuinely stronger
Their gateway does things we don't. It sits in the path and can block a tool call before it runs, it sandboxes execution, and its redact-then-unredact round trip is genuinely good UX: the downstream MCP server only ever sees tokens, while the human still gets a readable answer. Their detection surface covers injection, jailbreaks, toxicity and multimodal content, which we don't touch at all. They have SOC 2 Type 2, a Gartner Cool Vendor nod, a real red-team research brand, and an Apache-2.0 gateway a developer can install in ten minutes. Anaconda's distribution behind all that is not nothing.
Here's the question I'd still put to them. If the gateway detects PII, holds the mapping, and writes cleartext back into every response, then the gateway is a cleartext PII processor by construction, sitting on a mapping table, on the path of every call. That's not a flaw in their engineering, it's what inline redaction is. So ask where the mapping lives, whether it's encrypted at rest, what its TTL is, who can read it, whether the detection call leaves your network, and what proves each re-identification was authorised. We took the other road: tokenize the dataset at ingest so there's no cleartext chokepoint to protect, and make detokenization a privileged operation that lands in the chain.
Questions worth asking both of us
The questions below deserve an answer from both vendors. Don't give us a pass on them.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Every record commits to the previous one, and the checkpoints over them are signed and chained too, so pulling a checkpoint is as visible as pulling a row. Verification names the failure instead of shrugging. Live chain at /verify. Enkrypt AI: the open-source gateway logs requests to local files, and enterprise adds reporting and export packages; we found no tamper-evidence mechanism published. Audit-ready reasoning traces are a report, not a proof. Ask them to demonstrate the equivalent check.
What happens to a revoked agent mid-session?
Authority is evaluated at dispatch, on every governed tool call, so a revocation bites on the next call and the context downgrades with it. Enkrypt's published auth model is gateway and API keys with tool allowlists; we couldn't find a per-call authority re-check in their docs. Ask how long a compromised agent keeps working after you pull its access, and whether the answer is 'until we rotate the key'.
Where exactly does the unredacted data live?
This is the one I'd spend the most time on. Their gateway replaces PII with tokens before the MCP server sees the request, keeps the mapping keyed per request, and restores cleartext in the response. Ask: is the mapping encrypted at rest, what's the TTL, who can read it, does PII detection run as a call to their hosted service, and is every response logged with the cleartext in it? DataShield has no equivalent store because datasets are tokenized at ingest and detokenization is a privileged, audited operation rather than an automatic last step.
How does GDPR erasure interact with the audit trail?
Erasure here destroys the subject's key material and produces an ISO 27560 receipt. The chain isn't edited and doesn't need to be: actor identities in it are HMAC commitments, so it still verifies afterwards. Enkrypt's redaction is transient and we found no published erasure story for retained mappings or logs. If a subject asks to be deleted, ask what happens to the request and response records that contain their data.
Do we still need prompt injection detection if we run DataShield?
Probably, and we'd point you at Enkrypt or Lakera for it. We're the layer underneath detection: identity, authorization, and evidence. Through 2028, Gartner expects most unauthorized agent transactions to be internal policy violations rather than attacks. That's the half of the problem no detector is looking at. Most buyers who look seriously at both end up running both.
Does DataShield have SOC 2?
No, and Enkrypt has SOC 2 Type 2, which we score to them. The thing worth saying out loud is that SOC 2 attests to their organisation, not to your evidence. Auth is v1.0 with a published threat model and a verifier anyone can run; Guardian and Lighthouse are v0.2, in production since April 2026; design-partner terms include source escrow. Security page.
- Enkrypt AI's current positioning: "Ship Fast, Ship Safe, Stay Ahead" with the sub-head "Agentic Security & Compliance." — enkryptai.com, 13 Sep 2026
- Published self-serve pricing: free Explore tier, Launch at $149/mo, Scale at $1,499/mo on credit metering, Enterprise custom with unlimited VPC usage. — enkryptai.com/pricing, 13 Sep 2026
- Enkrypt AI was acquired by Anaconda; terms were not disclosed. — Enkrypt AI newsroom, checked 13 Sep 2026
- The Secure MCP Gateway is an Apache-2.0 bidirectional proxy with tool allowlisting, sandbox isolation, and local request logging; platform log forwarding was listed as coming soon. — github.com/enkryptai/secure-mcp-gateway, 13 Sep 2026
- Enkrypt AI announced SOC 2 Type 2 certification. — enkryptai.com, 11 Sep 2024
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
Other head-to-heads
DataShield vs MintMCP
Two takes on the MCP control point, and what each one can prove.
ComplementDataShield vs Lakera
Detection and governance are different layers. Most teams need both.
DirectDataShield vs Strac
Inline MCP interception versus identity, evidence, and break-glass.
AllEvery comparison
Eleven vendors, one honest scorecard each.
See the mechanisms a gateway doesn't have: break a live audit chain, revoke an agent mid-session, then decide what to pair. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →