Head-to-head · updated 13 September 2026
DataShield vs Onehouse: the lakehouse is fast enough for agents now. Who checks what they read?
Onehouse is a serious piece of data infrastructure. The people who built Apache Hudi built it, they gave OneTable to the Apache Foundation as XTable, and the pitch is blunt: "One Data Lakehouse. Any Cloud." Your files stay in your own buckets. Ingestion, table upkeep, a Spark runtime and a fast Postgres-shaped serving layer sit on top. If your Databricks bill is the problem, they have a real answer, and we have no interest in arguing with their TPC-DS numbers.
We are not a lakehouse. DataShield is the governed data plane and the evidence layer for what agents do with data. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is re-checked against the agent's current authority before it runs, and every decision is sealed into a hash chain anyone can verify. Their February 2026 Lakegres post says AI agents "think by querying inside their reasoning loops." We agree. That is exactly the moment somebody should be deciding whether this agent may see this column.
The short version
Pick DataShield when
- An agent is about to read a column with a patient ID in it, and you need the platform to say no before the row moves. Not flag it later.
- Someone will ask you to prove the access log was not edited. An auditor, an examiner, or Article 12 of the EU AI Act. Run the verifier and see what the answer looks like.
- You need to pull an agent's authority mid-session and have the very next tool call fail.
- You want a price before a sales call. Ours is published.
Pick Onehouse when
- Your storage and compute bill is the thing that hurts. That is the problem they were built to solve, and they publish benchmarks to back it.
- You want one physical copy of a table readable as Hudi, Iceberg or Delta. XTable is theirs, it is open source, and nobody else has that pedigree.
- You run at real scale across AWS, GCP and now Azure, and you need ingestion, compaction and a Spark runtime managed for you.
- SOC 2 Type II and PCI need to be on the table this quarter. They have both. We do not.
Bottom line: Onehouse decides where your data lives and how fast it moves. DataShield decides which agent may touch it and keeps proof of the decision. Those are different jobs, and running both is the normal answer.
Feature by feature
Competitor cells describe what Onehouse's public site and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Onehouse | Edge |
|---|---|---|---|
| Lakehouse storage and compute | Not our job. Ontology ingests files and streams from S3, Azure Blob, GCS, SFTP and SMB, snapshots to Parquet, and queries it with DuckDB over unconditionally masked golden views. That is a dataset platform, not a petabyte lakehouse. | The whole product. Managed Hudi, Iceberg and Delta tables, a Spark runtime, compaction and clustering, all inside your own cloud account. | ◇ |
| Table format interoperability | We do not translate table metadata. We read and write Parquet. | Apache XTable, which they created and donated. One physical dataset readable as three formats. Genuinely good work. | ◇ |
| Sensitive field classification | 129 built-in classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. Regex plus checksum validation, column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. | We found no field classification in their public material. Their March 2026 permissions post names PII masking as a reason for row-level rules that are still coming soon. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is privileged, tenant-scoped and logged. | Not vocabulary they use. Their answer to sensitive data is who may read the table. | ◆ |
| Access control | Every governed tool call passes a scope ceiling, an authority tier and a revocation re-check before dispatch. It fails closed. Golden views mask on read no matter how the deployment is configured. | OneSync Permissions syncs database-level and table-level grants across OneLake, Glue with Lake Formation, Unity Catalog and Snowflake Horizon. Useful and honest. Column-level and row-level rules are named as coming soon. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Try the verifier. | You can audit the permission sync history in the Onehouse console. That is a change log, not tamper evidence. We found no cryptographic chain. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes, needs a step-up, and cannot be quietly deleted from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after a subject is gone. | Nothing published. Erasing one person from Hudi or Iceberg history is hard, and it is worth asking them how they do it. | ◆ |
| MCP and agents | Native MCP on Auth, Ontology, Corpus and Lighthouse: more than 200 MCP tools. Tool tokens carry scope ceilings, calls are metered and attributed to the agent, and the decision is sealed into the chain. | Lakegres gives agents a Postgres-compatible endpoint into lakehouse tables, and they market a Spark AI agent for debugging. We found no MCP server and no agent authorization layer. | ◆ |
| Low-latency serving | DuckDB over Parquet, good for analysis and for agents reading governed datasets. We publish no latency benchmark, so treat this row as ours to prove. | Lakegres, February 2026: a Postgres-compatible serving layer claiming a 95% latency cut on point lookups over a 1 TB TPC-DS table. Built for agent query loops. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment or derive from your machine key today, not in a KMS. | Management services run on a data plane in your own cloud account, and they state that no data leaves the trust boundary of your private networks. AWS, GCP and Azure, plus AWS Marketplace. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Founded by the creator of Apache Hudi, $35M Series B in June 2024 led by Craft Ventures, SOC 2 Type II since 2023, PCI since 2024, and a logo wall with Uber, Robinhood and ByteDance on it. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Quote only. Their pricing page returned a 404 when we checked. The front door is a Free Test Drive. | ◆ |
◆ DataShield leads◇ Onehouse leads◈ comparable
Onehouse claims are drawn from onehouse.ai and the Onehouse blog, last checked 13 September 2026. We link the posts below rather than work from memory.
Three things you get here that you won't get from a managed lakehouse
Proof that survives an audit
A log an admin can edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
Authority that can change mid-flight
An analyst resigns on a Friday afternoon. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A table grant that syncs on a schedule does not do that. How Auth does it.
Columns that know what they hold
Before you can protect a field you have to know it is an MRN. We label columns against 129 classes, then tokenize or generalize the ones that need it, and the catalog stores no column values by default. See the catalog.
Where Onehouse is genuinely stronger
Let's be fair about the gap. Onehouse ships storage and compute at a scale we do not touch. Their table optimizer, their Spark runtime and their ingestion pipelines have been run against 350 TB a day by a single customer, by their own account. They created Hudi and XTable and gave the interoperability layer away, which is a costly thing to do and buys them real trust with data engineers. They hold SOC 2 Type II and PCI. We hold neither yet, and we are not going to dress that up. If you want an open lakehouse in your own cloud account, buy theirs. Our catalog scans PostgreSQL today, not Iceberg tables, and that limit is a real one.
Here is the push-back. Their two 2026 launches both reach for our lane and stop short of it. Lakegres exists because agents query in a loop, and it makes those queries fast. Nothing in it asks whether this agent, right now, may read this column, and nothing writes an artefact an examiner can check. OneSync Permissions is the honest one: it admits access is a product problem, syncs grants at the database and table level, and lists column-level and row-level rules as coming soon, with PII masking as the motivating example. A table grant is too blunt for an agent. Agents do not need a table. They need three fields, for eleven minutes, under a rule you can show someone later.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Onehouse: their console shows permission sync history, which is a useful record but not tamper-evident. We found no chain or signature scheme in their public material. Ask them what stops an admin from editing that history.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the very next call. Onehouse works through catalog grants that sync across OneLake, Glue, Unity Catalog and Snowflake Horizon. We could not find a sync interval or a mid-session behaviour in their docs. Ask how long a revoked identity keeps working while the grant propagates.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Onehouse publishes nothing on erasure. This matters more on a lakehouse than most places, because Hudi and Iceberg keep history on purpose. Ask them how one person disappears from table history without breaking time travel.
Is DataShield a lakehouse? Do we drop Onehouse?
No, and no. We do not manage Iceberg tables, we do not run Spark, and we have no TPC-DS number to wave at you. Our catalog provider is PostgreSQL today, with Snowflake, Databricks, BigQuery and S3 declared and not yet built. Keep the lakehouse. Govern the datasets agents actually query with us.
Lakegres already serves agents at database speed. What's missing?
Speed, not judgement. A Postgres-compatible endpoint answers the agent's question quickly. It does not know that column 7 is an MRN, it does not swap it for a token, it does not check that this agent still has authority, and it leaves nothing an examiner can verify. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks, and speed makes those faster too.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Onehouse does, plus PCI, and that is a fair point against us. What we offer instead is a published threat model, a verifier anyone can run, and source escrow in design-partner terms so a small vendor is not a single point of failure. Auth is live; Guardian and Lighthouse have been in production since April 2026. Details on the security page.
- Onehouse's positioning: "One Data Lakehouse. Any Cloud." and "Open Data Infrastructure in Your Own Cloud Account", with a Free Test Drive as the entry point. — onehouse.ai, 13 Sep 2026
- Lakegres: "a low-latency serving layer on top of open lakehouse tables" with a Postgres-compatible endpoint, claiming a 95% latency reduction for point lookups on a 1 TB TPC-DS table, built because "AI agents think by querying inside their reasoning loops." — Onehouse blog, 17 Feb 2026
- OneSync Permissions syncs database-level and table-level grants across Microsoft OneLake, AWS Glue with Lake Formation, Databricks Unity Catalog and Snowflake Horizon; column-level and row-level permissions, including PII masking, are listed as coming soon. — Onehouse blog, 13 Mar 2026
- Deployment model: management services run on a data plane inside your cloud account, and "no data ever leaves the trust boundary of your private networks." — onehouse.ai/product, 13 Sep 2026
- $35M Series B led by Craft Ventures with Addition and Greylock, announced alongside the quest for "the most open and interoperable data platform." — Onehouse blog, 26 Jun 2024
- Onehouse achieved SOC 2 Type II certification in August 2023; OneTable, now Apache XTable, was open-sourced in November 2023. — Onehouse blog, 29 Aug 2023 and 15 Nov 2023
Other head-to-heads
DataShield vs Starburst
DataShield vs Starburst: Starburst federates SQL across your estate and grounds AIDA in it. DataShield.
Same marketDataShield vs Estuary
DataShield vs Estuary: Estuary Flow owns real-time CDC and streaming ELT. DataShield adds field.
Same marketDataShield vs Dremio
DataShield vs Dremio: Dremio wins on Iceberg lakehouse query speed and scale. DataShield adds PII.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your lakehouse still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →