Head-to-head · updated 13 September 2026
DataShield vs OpenMetadata: your catalog tells the agent what the data means. What tells it no?
OpenMetadata is the best open-source data catalog running right now, and it is not close. 130+ connectors. Column-level lineage out of the box. A single metadata schema instead of a pile of aspects. 15,000 GitHub stars and 450 contributors. Version 2.0 landed in August 2026 with the MCP server installed and on by default, so an agent can read your catalog the hour after you deploy it. If you want a free catalog you can run yourself, download theirs. We mean that.
We took a different bet. DataShield Ontology has a catalog too, but it is the smaller half of the product. The rest is a classification kernel with 129 field classes, tokenization, an identity control plane for agents, and an audit chain you can verify without trusting us. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Below is the honest split, including the rows OpenMetadata wins outright.
The short version
Pick DataShield when
- The data is regulated. You need PII and PHI labelled at the column level, tokens over the sensitive fields, and a policy that fails closed. A catalog label is a note, not a control.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Our chain answers with math. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh. The next call.
- You want classification, tokenization, agent authorization and evidence from one stack you host yourself, instead of wiring four projects together and owning the seams.
Pick OpenMetadata when
- Your estate is wide and mostly not PostgreSQL. They have 130+ connectors. We have one that is GA, and we are not going to catch them.
- Lineage is the job. Column-level lineage, impact analysis and a real UI for it, free, today.
- Budget is zero and it has to stay zero. Apache 2.0, no seat count, no asset cap, self-host forever.
- You want a big community. 14,000 members, 450 contributors, and a Slack where someone has already hit your bug.
Bottom line: OpenMetadata is a catalog that learned to talk to agents. DataShield is a control plane that happens to carry a catalog. If your hardest question is what the data means, take theirs. If it is what the agent is allowed to do with it, and how you prove that later, take ours.
Feature by feature
Competitor cells describe what OpenMetadata's docs, GitHub releases and the Collate site say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | OpenMetadata | Edge |
|---|---|---|---|
| Connector coverage | We scan, profile and classify a live PostgreSQL source in place, with no rows leaving it. Snowflake, BigQuery, Databricks, SQL Server, S3 and Salesforce are declared on the roadmap with no handler yet. Separately we watch S3, Azure Blob, GCS, SFTP and SMB subtrees and ingest new files. | 130+ connectors across warehouses, BI tools, pipelines, ML platforms and message queues. The main reason people deploy it. | ◇ |
| Lineage | Typed lineage over a read-only predicate vocabulary, with access gating at both ends of every hop. It is derived from the pipelines that own the relationships, not a stored column graph, and there is no edge-write command. | Column-level lineage with a canvas UI, plus service, domain and product level views. Deeper than ours and easier to look at. | ◇ |
| PII and PHI classification | 129 built-in field classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. Regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. Cut over from shadow mode days ago, so call it new rather than battle-tested. | Auto-classification tags, a glossary, and OWL ontology import added in 2.0 so you can load a taxonomy you already own. Tagging, not a validated classification kernel. | ◆ |
| Tokenization and generalization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Both are features you switch on, not defaults. Detokenization is privileged and logged. | Not part of the product. The catalog describes data; it does not transform it. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names insertion, deletion and truncation separately. Try the verifier. | Change events, alerts and activity feeds. We found no cryptographic tamper evidence in their docs or release notes. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a revocation re-check before dispatch. It fails closed. Delegation is RFC 8693 token exchange with an enforced scope ceiling. | Real RBAC. Their MCP page says agents "assume any role or policy you define" using the same authorization engine as the REST API. That is role-based access to metadata, checked per request, with no per-agent scope ceiling or mid-session revocation that we could find. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin plus IP allowlist plus step-up, auto-revoking, fully audited. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. | Metadata retention and deletion of entities. Erasure of subject data is the source system's problem, which is fair for a catalog and still leaves you the problem. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Agents query governed data, not just metadata about it. Auth issues MCP tool tokens with scope ceilings and meters every call against the agent. | A genuine MCP server, shipping installed and on by default since 2.0 in August 2026. OAuth or a personal access token. It serves catalog context and can write back to entities. 2.0.1 trimmed the tool surface and stopped unauthenticated errors leaking stack traces. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS. | Docker or Kubernetes for the OSS build, Collate managed cloud, or bring-your-own-cloud on the big three. Wider set of options than ours. | ◇ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Founded 2021, $14.8M raised, 15,000 GitHub stars, 4,000+ claimed enterprise deployments, and Collate lists SOC 2 Type II. Older, bigger, more certified. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | The OSS core is free under Apache 2.0, which beats any price we can print. Collate's paid tiers publish seat and asset caps (5 users and 500 assets free, 25 and 5,000 on Premium, 50+ and 10,000+ on Enterprise) but no dollar figures, and enterprise-grade MCP sits on the top tier. | ◈ |
◆ DataShield leads◇ OpenMetadata leads◈ comparable
OpenMetadata claims are drawn from open-metadata.org, docs.open-metadata.org, the project's GitHub releases and getcollate.io, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from an open-source catalog
Proof that survives an audit
A change feed can be edited. A hash chain cannot, not quietly. Ours signs checkpoints and chains those too, and the verifier tells you what broke rather than just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call re-checks current authority and fails closed. An RBAC role you edited on Friday afternoon helps on Monday. How Auth does it.
Labels that do something
Most catalogs tag a column PII and stop. Ours binds the class to a mask type, a severity and a regulation reference, then the query path acts on it. Same label, different consequence. How the ontology is built.
Where OpenMetadata is genuinely stronger
We would rather you heard this from us. OpenMetadata ships more catalog than we do and it costs nothing. 130+ connectors against our one GA provider is not a gap we talk our way out of. Column-level lineage works on day one. The 2.0 release in August 2026 was a serious piece of engineering: dynamic sampling replaced full-table scans in data quality, governance intake forms landed, OWL import lets you bring an ontology you already maintain, and the MCP server now installs and runs by default. They patch fast too. Version 2.0.1 shipped eight days later and fixed an MCP error path that leaked stack traces to unauthenticated callers, which is the kind of bug you only find and fix in public if you are paying attention. Collate has SOC 2 Type II. We do not.
Here is the push-back, and it is narrow. Their MCP server hands an agent the catalog. Roles and policies decide which metadata it sees. That is real access control, and better than most catalogs offer. But the agent then goes and queries the actual warehouse through some other credential, and the catalog never sees that call. It cannot refuse it, it cannot tokenize what comes back, and it keeps no evidence an examiner would accept. The labels say PHI. Nothing downstream is obliged to care. If your agents only read metadata, none of this matters and you should use theirs. If they read the data, the obligation lands somewhere, and a catalog is not where it lands.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. OpenMetadata records change events and alerts. We found no tamper-evidence mechanism in the docs or the release notes. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call. OpenMetadata uses roles and policies on the MCP surface, the same engine as its REST API. We could not find a documented mid-session revocation path. Ask how long a token keeps working after you delete the role.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. OpenMetadata is a catalog, so subject erasure happens in the source system and the catalog re-ingests. Ask what happens to sampled values and profiles already in the metadata store.
We already run OpenMetadata. Do we rip it out?
Probably not, and this is the row where we differ from most of our compare pages. Both products are catalogs, so running both means two catalogs and a reconciliation job nobody enjoys. If OpenMetadata covers your estate and your agents only read metadata, keep it. Bring us in when the obligation is enforcement and evidence on regulated datasets. Some teams do split that way on purpose: their catalog for the estate, ours for the datasets agents actually touch.
Is this an OpenMetadata alternative for regulated data?
For PostgreSQL sources, yes. You get the catalog, plus 129-class field classification with reproducible verdicts, tokens over the sensitive columns, per-call agent authorization and a verifiable audit chain. For a wide estate of Snowflake, BigQuery and Salesforce, no. Those provider kinds are declared and not built. We would rather say that now than in week three of a deployment.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Collate does, on the managed cloud. What we offer instead is a public threat model, a verifier anyone can run, and design-partner terms that include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- OpenMetadata's hero: "The #1 open context layer for humans, AI assistants, and agents." Site lists 130+ connectors, 15,000+ GitHub stars, 450+ contributors. — open-metadata.org, 13 Sep 2026
- OpenMetadata 2.0: MCP server exposes catalog metadata to AI assistants and is enabled by default; OWL ontology import; dynamic sampling replaces full-row scans in data quality; Context Center replaces Knowledge Center. — GitHub release 2.0.0-release, 24 Aug 2026
- Their MCP server "uses the same Authorization engine we have for the OpenMetadata APIs" and agents can "assume any role or policy you define." — open-metadata.org/mcp, 13 Sep 2026
- MCP server ships installed and enabled by default, with OAuth or a personal access token for connection. — docs.open-metadata.org MCP guide, 13 Sep 2026
- Collate pricing lists Free (5 users, 500 assets), Premium (25 users, 5,000 assets) and Enterprise (50+ users, 10,000+ assets), with enterprise-grade MCP on the top tier and no dollar figures on any paid plan. — getcollate.io/pricing, 13 Sep 2026
- Collate raised a $10M Series A led by Venrock, bringing total funding to $14.8M. — PR Newswire, 15 Jul 2025
Other head-to-heads
DataShield vs DataHub
The other open-source catalog, and the same missing layer.
OSS catalogDataShield vs Amundsen
Search-first discovery, versus enforcement at the tool call.
GovernanceDataShield vs Collibra
Enterprise governance workflow, and the evidence it doesn't ship.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then go back to your catalog and ask it the same two questions. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →