Head-to-head · updated 13 September 2026

DataShield vs Presidio: what do you still have to build around a PII detection library?

Presidio is good. It finds PII in free text, in images, and in tables, it speaks about 18 country formats, and it costs nothing. It is MIT licensed, it has 10,832 stars, and it shipped a release two months ago. If you need to know whether a string holds a Swedish personal number, install it today.

But Presidio is a library, not a system. Its own docs say it keeps no state and that you must manage your own salt. So the vault, the access rules, the log, and the erasure story are all still your job. DataShield ships those. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Most teams here keep Presidio and stop hand-building the rest.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

You need to prove an access log wasn't edited. Ours is a hash chain with signed checkpoints. Presidio writes no log at all. Run the verifier.
Agents are in the picture, and their authority can change. We re-check it on every governed tool call, so a revoked agent fails on the next one. How Auth does it.
Someone has to hold the original values. We ship a vault, key custody, and a logged path back. Presidio's encrypt operator hands you ciphertext and wishes you luck.
A GDPR erasure request has to land without breaking the audit trail. Crypto-shred does that.

Pick Presidio when

You want detection in free text, right now, for nothing. Nobody beats free, and the recognizer set is deep.
The data is images, PDFs, or DICOM. Their image redactor handles those. We don't redact pixels.
You want to own the code. MIT licence, self-hosted, no contract, no seat count, no renewal call.
Your need is one country format or one odd entity type. Write a recognizer in an afternoon and move on.

Bottom line: Presidio tells you where the PII is and can scrub it. It does not say who was allowed to see it, keep the original safely, or prove any of it later. Those are different jobs. Run both.

Feature by feature

Competitor cells describe what Presidio's public docs and release notes say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.

What matters	DataShield	Presidio	Edge
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier.	None. Presidio is a function call. Logging is left to the host application.	◆
Agent authorization	Every governed tool call passes a scope ceiling, an authority tier, and a revocation re-check before dispatch. Revocation lands mid-session.	No concept of an actor. Anyone who can call the library can call it.	◆
Break-glass	Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log.	Not applicable to a library.	◆
GDPR erasure	Crypto-shred of per-subject key material plus ISO 27560 consent receipts. The chain still verifies after erasure.	No subject-level keys and no store, so no erasure mechanism to speak of.	◆
Tokenization and data handling	Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is a privileged, logged operation.	Operators for replace, redact, mask, salted hash, encrypt, and keep. Decrypt reverses encryption if you hold the key. Docs state Presidio keeps no state and that you must supply your own salt for referential integrity.	◆
Detection breadth	PII and PHI classification against 129 field classes, including all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats, with checksum validation, column-name lexicons and anti-pattern suppressors. Deterministic, so a verdict is reproducible from a config digest. Fewer languages than they cover, and no NER model.	About 14 global entities, roughly 18 country packs, 8 medical types. Backends include spaCy, transformers, GLiNER, LangExtract, and Azure AI Language.	◇
Images and documents	No image redaction. We do extract and scan text from PDF, DOCX and EML files.	Image redactor with OCR, plus DICOM support for medical imaging.	◇
MCP and agents	Native MCP endpoints on Auth, Ontology, and Lighthouse. MCP tool tokens with scope ceilings, and per-call metering attributed to the agent.	Nothing native. LiteLLM embeds Presidio as a guardrail and offers a `pre_mcp_call` mode, so it can mask strings before an MCP call. It still can't say if the call was allowed.	◆
Deployment	Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys.	Self-hosted by definition. Python package or two Docker containers, analyzer and anonymizer.	◈
Maturity signals	Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	Started at Microsoft in 2018. Now community governed under the Data Privacy Stack org. 10,832 stars, 1,285 forks, last push 10 September 2026. No certifications apply to a library.	◇
Support and ownership	Commercial vendor, small team. Design-partner terms include source escrow.	Volunteer maintainers. Microsoft handed stewardship over and says it supports the move. Nobody owes you a patch.	◈
Pricing	Published model, scoped instant quote, no sales wall.	Free. MIT. This row is not close.	◇

◆ DataShield leads◇ Presidio leads◈ comparable

Presidio claims are drawn from the project docs at presidio.dataprivacystack.org and the GitHub release notes, last checked 13 September 2026. We link them below rather than paraphrase from memory.

Three things you get here that you won't get from a detection library

Proof that survives an audit

A log you can edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier says what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers look for. Presidio writes no log, so the log is whatever your app wrote. Try ours in your browser, no signup.

A key you don't have to babysit

Presidio's docs are honest: no state, bring your own salt, hold your own key. That is fine in a notebook. In production it means one engineer owns a secret that can undo every mask you ever applied. We put that behind a vault with custody, rotation, and a logged path back. See the architecture.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is still 20 minutes into a job. We re-check authority on the next governed tool call and fail closed. A masking step in the pipeline has no opinion on this, because it doesn't know who is asking. How Auth does it.

Where Presidio is genuinely stronger

Let's be fair about this. Presidio has been going since 2018, it is MIT licensed, and it does one hard thing well: spotting personal data in messy text. The recognizer catalogue keeps growing, with German, Swedish, Canadian and UK additions in the last two releases alone. It runs spaCy, transformers, GLiNER or an LLM through LangExtract, so you can trade speed against accuracy. It redacts images and DICOM files, which we do not do at all. And in 2026 the project moved out of Microsoft into community governance, which several buyers told us they read as a plus, not a risk. If your problem is "find the PII in this blob", the answer is Presidio and you can stop reading.

The push-back is about what happens next. Detection is a step in a pipeline. A control is something an examiner can inspect. Their own anonymizer page says Presidio keeps no state and that you must supply your own salt for referential integrity across records. That single sentence is the gap: no vault, no custody, no actor, no log. Teams fill it with a Postgres table, a KMS key, and a Slack thread about who has access. It works until March, when someone asks for the March logs and you find out the table has no integrity guarantee. That is the part we sell, and we'd rather you keep Presidio for the detection.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and tampering. Try it at /verify. Presidio: no, and it doesn't claim to. It is a library with no store and no log. Whatever your app wrote is the whole evidence story, so ask your own team the same question.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation bites on the next call. Presidio has no notion of an agent. Even in the LiteLLM setup, where a Presidio guardrail runs before an MCP call, it masks strings and passes the call along. It cannot block a call the agent should no longer be making.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies after the subject is gone. Presidio holds no subject data, so erasure is a question for whatever you built around it. If that's an encrypted column and one shared key, erasing one person is hard.

Is DataShield a replacement for Presidio?

No, and we'd rather say so. Presidio is a PII detection and anonymization library. We classify and tokenize datasets at ingest, then govern what agents do with them. Several teams run Presidio over free text and chat logs, and run us over the datasets agents query. The question isn't which tool wins, it's which layer the obligation lands in.

We already use Presidio's encrypt operator. Isn't that reversible tokenization?

It's reversible, which is the important half. What it isn't is governed. Decrypt is a function that takes a key, so anyone holding the key can re-identify anyone, with no record. Our tokens are deterministic and join-preserving so analytics still work, and detokenization is a privileged, audited operation. That's the difference between a cipher and a control.

Does DataShield have SOC 2?

Not yet, and we won't imply otherwise. Auth is live a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor isn't a single point of failure. Details on the security page.

Presidio is "an open-source framework for detecting, redacting, masking, and anonymizing sensitive data (PII) across text, images, and structured data". MIT licensed, 10,832 stars, 1,285 forks, last push 10 September 2026. — GitHub, data-privacy-stack/presidio, 13 Sep 2026
Presidio moved from Microsoft to "an independent, community-governed open source project under the new GitHub organization Data Privacy Stack". Microsoft "supports this transition". — Presidio docs, project transition update, 13 Sep 2026
"Presidio does not store or maintain stateful sessions. For referential integrity across records or calls, users must securely manage and provide their own salt." Operators: replace, redact, mask, hash, encrypt, custom, keep. — Presidio anonymizer docs, 13 Sep 2026
Release 2.2.364 (22 July 2026) added batch deanonymization and recognizer-level thresholds; 2.2.361 added an LLM-based LangExtract recognizer and salted hashing. — GitHub releases, microsoft/presidio, 13 Sep 2026
LiteLLM ships a Presidio PII guardrail with pre_call, post_call, logging_only and pre_mcp_call modes, run as two Docker containers. — LiteLLM docs, 13 Sep 2026
EDPB names pseudonymization as a GDPR risk mitigation for AI models. — EDPB Opinion 28/2024

Other head-to-heads

Adjacent

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →