Head-to-head · updated 13 September 2026
DataShield vs MotherDuck: same DuckDB engine, very different job
MotherDuck took DuckDB and made it a serverless data warehouse. Their pitch is blunt and mostly right: "faster and significantly less expensive than Snowflake, BigQuery or Redshift, designed for humans, agents and applications." Every user and every agent gets an isolated DuckDB instance that starts in about 100ms. They ship an MCP server with read and write access, agent-built pipelines, a CLI, and a signup endpoint an agent can POST to on its own. Their pricing page lists every rate. We like this company.
We run DuckDB too. Ours sits over Parquet and reads golden views that are masked whether or not anyone remembered to switch masking on. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Same engine, different job: they sell you warehouse capacity, we sell the governed surface an agent is allowed to touch, plus the evidence that it stayed inside the lines. Most teams could reasonably run both.
The short version
Pick DataShield when
- The rows an agent will query carry PHI or regulated PII, and someone has to say what the agent saw. We classify fields against 129 built-in classes, then serve masked views. How the ontology layer works.
- You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh. The next call. Auth does this.
- An examiner will ask you to prove the access log was not edited. Our chain answers with math you can run yourself. Try the verifier.
- The data cannot leave your building. We ship Docker images and run self-hosted, or as a dedicated single-tenant server we operate for you.
Pick MotherDuck when
- You want a warehouse, not a governance layer. They are cheaper and faster than the big three for small and mid-size data, and they publish the benchmarks.
- Elasticity matters. A Duckling per user or per agent, up in 100ms, down when idle, is a genuinely good design and we do not do it.
- Your agents build as well as read. Flights run scheduled Python jobs, Dives make shareable charts, and the Tower acquisition in August 2026 was bought for exactly that.
- You need SOC 2 Type II today. They have it. We do not, and we will not pretend.
Bottom line: MotherDuck is where agents run fast SQL cheaply. DataShield is where agents run SQL you can defend. If your data is boring, buy the duck. If a column in it would ruin your week on a slide in front of a regulator, put us in front of that column.
Feature by feature
Competitor cells describe what MotherDuck's public site, docs and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | MotherDuck | Edge |
|---|---|---|---|
| Query engine | DuckDB over Parquet. Single node, columnar, fast on the shapes agents ask for. The attach relation reads masked golden views, so the engine never sees raw values on that path. | DuckDB, serverless, with hypertenancy. Every user and agent gets an isolated instance that starts in about 100ms and stops when idle. Read-scaling replicas on paid tiers. | ◈ |
| Warehouse economics and scale | You size your own box. No autoscaling, no per-second billing, no replica fleet. | The whole product. Five instance types from $0.60 to $24.00 an hour, storage at $0.04 per GB a month, and a free tier that is actually usable. Together AI runs 128 self-service users across 40 read-scaling replicas. | ◇ |
| PII and PHI handling | Field classification against 129 classes, including all 18 HIPAA Safe Harbor identifiers, using regex, checksum validation, column-name lexicons and anti-pattern suppressors. Verdicts are deterministic and reproducible from a config digest. Masked golden views mask unconditionally. | We found none. No classification, tokenization, redaction or generalization appears anywhere in their docs or blog, at any tier. An agent with a grant sees the rows as they are. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is privileged, tenant-scoped and logged, and the lookup fails if the audit write fails. | Not vocabulary they use. Secrets are encrypted and user-scoped, which is a different thing. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the failure: tampering, insertion, deletion or truncation. Run it. | Query history on Business and above, a QUERY_HISTORY view, and Duckling-level activity monitoring. Useful, and a normal database view. We found no tamper-evidence mechanism. | ◆ |
| Agent authorization | Every governed tool call on Auth passes mid-session authority revalidation, a consented-tool allowlist, a scope ceiling and an authority tier before dispatch, then metering, then a sealed audit row. It fails closed. | RBAC with Admin, Builder and Explorer roles, custom roles on Business and above, table-level security on shared databases, and GRANT and REVOKE on shares. Grant-time access control. We found no per-call decision point. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, admin and IP-allowlist gated, step-up verified, fully audited, and it auto-revokes. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of the subject key, which destroys every ciphertext for that subject at once, plus ISO 27560 consent receipts. The audit chain still verifies afterwards because actor identities are HMAC-committed. | GDPR and CCPA controls covering residency, transfers and erasure rights, with EU regions in Frankfurt and Dublin. The erasure mechanism itself is not described. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and every call is metered and attributed to the agent. Delegation is RFC 8693 token exchange with an enforced ceiling. | A real MCP server with fuzzy catalog search, query guidelines, shares, and read plus write access, so an agent can persist results back. Agents can also sign themselves up: a POST to new.motherduck.com returns a token and a claim URL. That is a better onboarding story than ours. | ◇ |
| Context for agents | A catalog with a business glossary from entity types, typed lineage with per-hop access gating, and stewardship worklists. Built for governance first, agent prompting second. | Guides: markdown context objects versioned and queryable in the warehouse, with org-level and user-level ownership, plus topic categorization so agents can search across hundreds of them. A neat idea, shipped July 2026. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment or derive from your machine key today, not in a KMS. | SaaS only. Data lives in MotherDuck's AWS environment, with region choice, PrivateLink and IP allowlisting on Enterprise. There is no self-hosted MotherDuck, only raw DuckDB without the managed parts. | ◆ |
| Certifications | SOC 2 not yet certified, and we say so on every page. | SOC 2 Type II covering security, availability and confidentiality. HIPAA BAA on Enterprise by request. AES-256 at rest, TLS 1.2 or higher in transit. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). Field classification cut over from shadow mode this month, so it is new. We would rather you knew. | Founded 2022, GA June 2024, around $100M raised, a first acquisition in August 2026, a named customer list, and their own conference in November 2026. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Fully public down to the instance-hour. Lite free, Business $250 per org a month plus usage, Enterprise custom. Rare honesty for a warehouse vendor. | ◈ |
◆ DataShield leads◇ MotherDuck leads◈ comparable
MotherDuck claims are drawn from motherduck.com, its docs and its blog, last checked 13 September 2026. We link the pages below rather than work from memory.
Three things you get here that you won't get from a managed warehouse
Masking that does not depend on a setting
Our masked golden views mask every time. They do not consult the deployment posture, because that was the one switch nobody would remember to flip. The DuckDB attach surface reads those views. An agent asking for a customer table gets the masked shape by construction. What the ontology layer serves.
Authority that can change mid-flight
An analyst hands in their notice on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call revalidates authority and fails closed. A warehouse with grant-time RBAC keeps serving rows until someone runs a REVOKE. How Auth does it.
Proof an examiner can check without you
Query history is a table. Tables can be written to. Our log is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Break a chain in your browser.
Where MotherDuck is genuinely stronger
Almost everything to do with being a warehouse. Hypertenancy is a smart architecture and we have nothing like it: a fresh DuckDB per agent in 100ms, scaled by replica, billed by the second, then gone. Their agent ergonomics are ahead of ours across the board. An agent can POST to an endpoint and get its own database, with no credentials to fumble and no human in the loop. Guides put versioned context in the warehouse where the queries already live. Flights let an agent write a pipeline, not just a SELECT. They bought Tower in August 2026 to make that real rather than announcing a roadmap. They hold SOC 2 Type II and offer a HIPAA BAA on Enterprise, which is more paper than we carry. And their September 2026 numbers on agent behaviour, 29 times more queries than humans and a median agent query scanning 7,000 rows against 200,000 for a person, are the most useful public data anyone has published on what agents actually do to a database.
Here is the push-back, and it follows from their own number. If agents now run 29 times the queries humans do, in four-second bursts, then the question of what those queries returned stops being a footnote. Their stack answers it with a role grant and a history view. Nothing in their material classifies a column as PHI, masks it before it lands in a model's context, re-checks the agent's authority at the call, or gives you an artefact an auditor can verify without trusting the vendor's database. That is not a criticism of their product. It is a description of a different product, which is the one we build. Run their warehouse for the data that does not scare you. Run ours in front of the data that does.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification separates deletion from truncation and from tampering. Re-tampering a chain that was already marked damaged un-marks it, so you cannot launder a break. Run it at /verify. MotherDuck: query history and Duckling activity monitoring on Business and above. It is a view over a database. Ask them who can write to it.
What happens to a revoked agent mid-session?
DataShield revalidates authority on every governed tool call, so revocation lands on the next call and the context drops to anonymous. MotherDuck uses RBAC with GRANT and REVOKE plus table-level security on shares. We could not find a mid-session enforcement point in their docs. Ask how long a running agent keeps querying after you revoke, and whether an open Duckling is affected at all.
How does GDPR erasure interact with the audit trail?
DataShield destroys the subject's key material, which makes every ciphertext for that subject unreadable at once, and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies. MotherDuck lists GDPR and CCPA controls including erasure rights and EU regions. The mechanism behind the right is not described. Ask for the mechanism, not the policy page.
You both run DuckDB. What actually differs?
The engine is the same idea and the plumbing is not. Theirs is managed, serverless and elastic, over their storage in AWS. Ours is DuckDB over Parquet in your own deployment, and the attach relation reads golden views that mask unconditionally rather than reading base tables. So the difference shows up in what a query can return, not in how fast it runs. If you want capacity, they are better at capacity. If you want a query surface where the sensitive columns are already handled, that is ours.
Is DataShield a MotherDuck alternative, or do we run both?
Mostly both. We are not a warehouse. We do no autoscaling, no replica fleet, no per-second billing, and we are not going to be cheaper than they are at general analytics. Put the regulated datasets behind us, where classification, masking, tokenization, per-call authorization and the audit chain apply, and leave the rest where the economics are better. The overlap is narrow: agents querying an analytical database over MCP. That is the one place we would ask you to compare us directly.
Does DataShield have SOC 2?
Not yet, and MotherDuck does, so this row goes to them. What we offer instead is checkable mechanism: a published threat model, a verifier anyone can run, Docker images with a signed deploy manifest that Guardian checks, and design-partner terms that include source escrow so a small vendor is not a single point of failure. Details on the security page.
- MotherDuck's positioning: a serverless data warehouse built on DuckDB, "designed for humans, agents and applications," with a Duckling per user or agent starting in about 100ms. — motherduck.com, 13 Sep 2026
- SOC 2 Type II certification, HIPAA BAA on Enterprise by request, AES-256 at rest, TLS 1.2 or higher, RBAC roles, QUERY_HISTORY view, PrivateLink on Enterprise, EU regions in Frankfurt and Dublin. — MotherDuck docs, security concepts, 13 Sep 2026
- Published pricing: Lite free, Business $250 per org per month plus usage, Enterprise custom; compute from $0.60 to $24.00 per hour; storage $0.04 per GB per month. — motherduck.com pricing, 13 Sep 2026
- Agents ran 29 times more queries than humans in the last month, up from 6x then 16x; median agent query scans 7,000 rows against 200,000 for a human. — MotherDuck blog, 2 Sep 2026
- MotherDuck acquires Tower for runtime infrastructure with sandboxing, scheduling and observability: "Agents Can Answer. Now They Can Build." — MotherDuck blog, 25 Aug 2026
- Agents can sign themselves up: a POST to new.motherduck.com returns a token plus a claim URL, with "no credentials, no shell, no network" handed to the agent. — MotherDuck blog, 10 Aug 2026
- Guides put versioned, queryable markdown context in the warehouse, owned at org and user level, for agents to search. — MotherDuck blog, 29 Jul 2026
Other head-to-heads
DataShield vs Snowflake Cortex Search
Retrieval inside the warehouse, versus governance in front of it.
Vector DBDataShield vs Pinecone
Retrieval at scale, and the masking step it leaves to you.
Vector DBDataShield vs Weaviate
Open-source search, plus the evidence layer agents need.
AllEvery comparison
One honest scorecard per vendor.
See the mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then ask your warehouse what it would have done. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →