Head-to-head · updated 13 September 2026

DataShield vs LlamaIndex: who governs the documents your agent just parsed?

LlamaIndex is very good at the job it picked. Point LlamaParse at a scanned loan file with three rotated pages and a table that spans a fold, and you get clean markdown back for about a penny a page. Their own ExtractBench, run over 370 documents and 4,869 pages, puts their top tier at 95.6% value F1. The framework is MIT-licensed, the docs are good, and 25 million people a month download it. We use tools like this. We are not here to tell you it is bad.

We are a different layer. DataShield is the governed data plane the agent reads from after the parsing is done. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings are computed locally, so no chunk of your document leaves the building to become a vector. Every governed tool call is checked against the agent's current authority before it runs, and the decision is sealed into a hash chain you can verify. Most teams who buy us will keep their parser. Below is the honest split, rows they win included.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

The data your agent reads is regulated, and you need it tokenized or generalized before a prompt is built, not masked after retrieval. How the data plane works.
Someone will ask you to prove an agent's access log was not edited. An auditor, or Article 12 of the EU AI Act. Our chain answers with math. Run the verifier.
You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
Self-hosting is the requirement, not the upgrade. Everything runs on your own infrastructure, on keys you hold, at any plan size.

Pick LlamaIndex when

Your hard problem is the document itself: scans, tables, charts, handwriting, 200-page filings. That is what LlamaParse and LlamaExtract are built for, and we do none of it.
You want to start free tonight. The framework is MIT, the cloud tier gives you 10,000 credits a month, and nobody makes you talk to sales.
You need SOC 2 Type II and a signed BAA today. They have both. We do not have SOC 2 yet, and we say so.
Your team already writes against the LlamaIndex API. Hundreds of integrations and a huge community are a real asset, and switching costs are real too.

Bottom line: LlamaIndex turns your documents into text an agent can read. DataShield decides what that agent may read, tokenizes the sensitive parts first, and keeps proof of every call. They are the parser; we are the plane the parsed data lands on. Running both is the normal answer.

Feature by feature

Competitor cells describe what LlamaIndex's public site, docs and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What matters	DataShield	LlamaIndex	Edge
Document parsing and OCR	We extract text from PDF, DOCX and EML files at ingest and store it as a versioned derived file. That is text extraction, not layout-aware OCR. No vision model, no table reconstruction, no handwriting.	The core product, and the best part of it. Four priced tiers from Fast to Agentic Plus, a published benchmark over 4,869 pages, and a Turbo tier added in September 2026.	◇
Structured extraction	Not our job. We profile, classify and score the dataset once the values are in, with a 20-section analysis profile per dataset.	LlamaExtract takes a schema and returns typed fields with confidence scores and citations. Deep Extraction handles long files.	◇
Tokenization and data handling	Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is privileged and logged.	The only PII tool is an open-source Presidio post-processor that masks text after retrieval. Its own post says "Nothing is bulletproof." We found no PII feature native to LlamaCloud.	◆
Retrieval and embeddings	Postgres pgvector with hybrid keyword and vector search. Embeddings run locally on nomic-embed-text, so no chunk of your data is sent out to be embedded. Chunk views apply read-time masking and the keyword index is rebuilt from the masked text, so search cannot be used to probe for a redacted value.	A hosted Index with tuned chunking, embedding and retrieval, plus connectors. Worth knowing: they said in April 2026 they are shifting focus away from storage and retrieval, and archived the index MCP server in August.	◈
Agent authorization	Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier check and a revocation re-check before dispatch. It fails closed. Delegation uses RFC 8693 token exchange with an enforced scope ceiling.	The SharePoint connector writes ACL fields such as allowed_siteUser_ids onto chunks. Their guide then tells you to build an app that treats them appropriately. That is metadata for you to enforce, not enforcement.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns one of three verdicts and names the failure: tampering, insertion, deletion or truncation. See the demo.	OAuth login and OpenTelemetry traces on the hosted MCP server. Traces are useful for debugging. We found no tamper-evidence mechanism in their public docs.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes, is IP-allowlisted and step-up gated, and cannot be quietly removed from the log.	Not described in their public material.	◆
GDPR erasure	Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the audit still verifies after the subject is gone.	Their published data-handling line is that cached data is deleted after 48 hours and caching can be switched off. What erasure means for an index you built is left to you.	◆
Prompt path	We do not proxy your LLM traffic. We do gate every value that leaves a governed dataset for a prompt, and a PHI dataset refuses an endpoint without a BAA. A classified column with no configured treatment is redacted rather than passed through.	Content goes to their parsers and, on the agentic tiers, to a vision model. Keeping it in your tenant means the Enterprise plan, or running LiteParse yourself.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and every call is metered and attributed to the agent.	A hosted MCP server at mcp.llamaindex.ai with Parse, Classify, Extract, Split and upload tools, behind OAuth, plus agent skills for Claude Code. Good distribution. Six document tools, no policy layer.	◈
Deployment	Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM; HMAC tokenization keys sit in your environment today, not in a KMS.	Multi-tenant SaaS in US and EU regions. Private VPC, hybrid and on-prem are Enterprise-tier, custom-priced. LiteParse Server is free to self-host, but it is the light extractor, not the accurate one.	◆
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. Field classification shipped recently, so call it new rather than battle-tested.	Founded 2022, $27.5M disclosed plus Databricks and KPMG stakes, 52k GitHub stars, SOC 2 Type II, HIPAA BAAs on Enterprise, and a customer list with Carlyle, KPMG and Boeing's Jeppesen on it.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Published too: 1,000 credits for $1.25, Free at $0, Starter $50, Pro $500, Enterprise on request. Credit maths takes a minute, but the numbers are on the page.	◈

◆ DataShield leads◇ LlamaIndex leads◈ comparable

LlamaIndex claims are drawn from llamaindex.ai, its pricing page and its own blog posts, last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from a document pipeline

Proof that survives an audit

A log that can be quietly edited proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Traces are for you. Evidence is for them. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job over the claims corpus. With DataShield the next governed tool call is re-checked against current authority and fails closed. A metadata field on a chunk cannot do that, because nothing reads it unless your app remembers to. How Auth does it.

Sensitive values handled before the model, not after

Masking retrieved text is the last possible moment to act, and it has already been embedded by then. We tokenize or generalize at ingest, and the values an agent reads are the treated ones. Erasure works the same way: destroy the subject's key material and the data goes unreadable while the chain still verifies. See the diagram.

Where LlamaIndex is genuinely stronger

Start with the obvious. They parse documents far better than we do, and the gap is not close. LlamaParse handles scans, rotated pages, nested tables and charts; we read text out of PDF, DOCX and EML files and stop there. Their September 2026 post on just-in-time OCR is a smart piece of engineering writing, and their per-page prices are public and cheap. They also win on reach: a free MIT framework, 52,000 stars, hundreds of integrations, a hosted MCP server your agent can call today, SOC 2 Type II, HIPAA BAAs and EU data residency. If your problem is a filing cabinet, buy them and get on with it.

Here is the push-back. Their permission story stops at metadata. The SharePoint connector copies ACL fields onto chunks and the guide hands enforcement to your application, which means the control lives in code your agent can skip. Their PII story is a post-retrieval masker whose own blog post says nothing is bulletproof. And the product they are moving away from, by their own words, is the storage and retrieval layer that would have to carry any of this. That is a sensible business call for them. It just leaves the part a regulated buyer needs sitting on your side of the line, which is the part we build.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. LlamaIndex: their MCP server emits OpenTelemetry traces and rate-limits by user. Traces are mutable by design. Ask them what stops a trace from being edited.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call and the call fails closed. LlamaIndex authenticates the MCP server with OAuth at login. We could not find a mid-session authority re-check in their public docs. Ask how long a revoked user's agent keeps parsing.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. LlamaIndex publishes a 48-hour cache deletion window and lets you turn caching off. Erasing a person from an index you built with them is your problem to solve. Ask for the mechanism.

Do we drop LlamaIndex if we buy DataShield?

No. We do not parse scanned documents and we are not going to pretend otherwise. The normal shape is LlamaParse or LiteParse on the ugly files, then DataShield as the governed dataset and corpus the agent actually queries, with tokenization at ingest and a tool token on every call. If your only problem is document quality, you do not need us yet.

Their permission-aware retrieval sounds like authorization. Is it?

It is metadata. LlamaCloud's SharePoint connector writes fields like allowed_siteUser_ids onto each chunk, and their guide then says you can build an app that treats them appropriately. So the filter lives in your retrieval code. If an agent calls the index directly, or a developer forgets the filter, nothing refuses. Ours refuses at the tool call, before the handler runs, and writes the refusal to the chain.

What about running LlamaParse on PHI?

Ask them which tier keeps the document inside your tenant. On the agentic tiers the page content goes to a vision model, and private VPC is an Enterprise-plan feature. They do sign BAAs at that tier, which is more than many vendors offer. On our side: we do not proxy your LLM traffic, but every value leaving a governed dataset for a prompt passes a fail-closed gate, and a PHI dataset refuses an endpoint that is not marked BAA or zero-retention.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. LlamaIndex has SOC 2 Type II and we do not. What we offer instead is a published threat model, a verifier you can run yourself, and source escrow in design-partner terms so a small vendor is not a single point of failure. Auth is live; Guardian and Lighthouse have run in production since April 2026. Details on the security page.

LlamaIndex's current hero: "Turn Any Document Into AI-Ready Context," with "1B+ documents processed" and "25M+ package downloads per month." — llamaindex.ai, 13 Sep 2026
ExtractBench: 370 enterprise documents, 4,869 pages, 8 domains, 67 document types; Agentic Plus at 95.6% value F1 for 8.1 cents a page. — LlamaIndex blog, 11 Aug 2026
Hosted LlamaParse MCP server with Parse, Classify, Extract and Split behind OAuth, "shifting its focus from storage and retrieval toward document processing." — LlamaIndex blog, 29 Apr 2026
Permission-aware retrieval writes SharePoint ACL fields onto chunks, then leaves the query-time filter to the customer's own application. — LlamaIndex blog, 6 Dec 2024
Their PII guidance is an open-source Presidio post-processor applied after retrieval: "Nothing is bulletproof." — LlamaIndex blog, 13 Mar 2024
Published pricing: 1,000 credits for $1.25; Free, Starter $50/mo, Pro $500/mo, Enterprise custom with private VPC, SSO and custom BAAs; cached data deleted after 48 hours. — llamaindex.ai/pricing, 13 Sep 2026

Other head-to-heads

Ingestion

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →