Head-to-head · updated 13 September 2026

DataShield vs Prefect: the job ran on time, but can you prove what the agent read?

Prefect does one thing very well. You write plain Python, add a decorator, and get retries, scheduling and state for free. Their hero line is "Start with one flow. Scale to millions." On 13 July 2026 they bought Dagster Labs, and from August the two best known standalone orchestrators run under one name. They also maintain FastMCP, which powers roughly 70% of MCP servers in any language. If you build MCP servers in Python, you already use their code. That is not a claim we can wave away, and we are not going to try.

We orchestrate nothing. DataShield is the governed data plane under the jobs you already run. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is re-checked against the agent's current authority before it runs, and every decision is sealed into a hash chain you can verify without trusting us. Below is the honest split, including the rows Prefect wins.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove an agent's access log was not edited. An auditor, an examiner, or Article 12 of the EU AI Act. Our chain answers with maths, not a policy PDF. Run the verifier.
You need to pull an agent's authority mid-session and have the very next call fail. Not the next token refresh. The next call.
The data itself has to be tokenized and classified before an agent ever sees a row, with 129 field classes covering PII, PHI, money and secrets.
Policy, keys and evidence all have to run on your own infrastructure. Docker images ship for Auth, Ontology, Corpus and Lighthouse.

Pick Prefect when

You need to run pipelines. That is the job they were built for, and we do not do it at all. Buy the orchestrator.
Your team writes Python and hates YAML. The @flow and @task model is a joy, and the OSS core is free.
You want an MCP registry and gateway in the same account as your scheduler. Horizon deploys OAuth 2.1 server URLs and talks to 65+ identity providers.
You need a SOC 2 Type II report and SCIM on the contract this quarter. They have both. We have neither, and we will not pretend.

Bottom line: Prefect runs the job and guards the door to the tool. We guard the data behind that door, and keep a receipt an auditor can check. Most teams who buy us will keep their orchestrator, and should.

Feature by feature

Competitor cells describe what Prefect's public site says as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What matters	DataShield	Prefect	Edge
Pipeline orchestration	None. We ingest, catalog, transform, snapshot and run workflows inside Ontology, but we are not a scheduler and we will not sell you one.	The core product, and a good one. Python-native flows, dynamic runtime graphs, retries, caching, hybrid workers, plus Dagster's asset model since the July 2026 deal.	◇
Audit evidence	SHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the break. Try the verifier.	Audit logs per MCP server in Horizon, and custom audit retention at Enterprise. Useful records. We found no cryptographic tamper evidence.	◆
Agent authorization	Every governed tool call passes a consented-tool allowlist, a scope ceiling, an authority tier and a live revocation re-check before dispatch. It fails closed. Cedar handles admin, config and token decisions, not the dispatch path.	Horizon enforces tool-level RBAC at the gateway, anchored in your IdP. Real work, and better than most. It gates which tools a caller may reach, not what the data behind them says.	◆
MCP gateway and registry	No registry of third-party servers, and no remixing of other people's tools. We ship our own surface: more than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse.	Horizon is a named product: Deploy, Registry, Gateway and Remix, with OAuth 2.1 and 65+ identity providers. If you want a catalogue of MCP servers, this is the better buy.	◇
PII and PHI classification	129 field classes with deterministic, reproducible verdicts, including all 18 HIPAA Safe Harbor identifiers, 11 secret types and checksum validators. We scan and profile a live PostgreSQL source in place, with no rows leaving it. PostgreSQL today, not your whole estate.	Not in the product. A flow can call a classifier you wrote, but nothing in Prefect knows a column holds an MRN.	◆
Tokenization and de-identification	Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column.	Not a feature. Masking is whatever your pipeline code does.	◆
Break-glass	Scoped, time-boxed emergency access for agents. It auto-revokes, is step-up gated, and cannot be quietly dropped from the log.	Not described in their public material.	◆
GDPR erasure	Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after the subject is gone.	"GDPR compliant" on the security page. Log and run retention windows are configurable at Enterprise. The erasure mechanism is not described.	◆
Prompt path	We do not proxy your LLM traffic. We do gate every value that leaves a governed dataset for a prompt, and a PHI dataset refuses an endpoint without a BAA.	Flows call whatever model you point them at. There is no egress gate on the values in a prompt.	◆
Identity plumbing	SAML, OIDC, OAuth 2.1, passkeys, RFC 9068 tokens, RFC 8693 delegation with an enforced scope ceiling, and a Connection Vault with eight credential strategies. No SCIM endpoint at all.	SSO, RBAC and ACLs, SCIM directory sync, IP allowlisting and PrivateLink, all at Enterprise. The SCIM row is theirs outright.	◇
Deployment	Self-hosted in your own cloud or data centre, or a dedicated single-tenant server we operate. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS.	Apache 2.0 core you can run yourself, managed Cloud, or a hybrid where workers stay on your side and the control plane stays on theirs.	◈
Maturity signals	Auth, Ontology, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so.	Founded 2018, 51.5k+ GitHub stars, SOC 2 Type II with a trust centre, GDPR, HIPAA ready, and they were the buyer in the Dagster deal rather than the seller.	◇
Pricing	Published model, scoped instant quote, no sales wall.	Published too: free Hobby, $100 a month Starter, then $100 per user a month at Team. Enterprise is a quote. Watch the step when your fourth user arrives.	◈

◆ DataShield leads◇ Prefect leads◈ comparable

Prefect claims are drawn from prefect.io, prefect.io/horizon, prefect.io/pricing, prefect.io/security, gofastmcp.com and dagster.io/prefect, last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from an orchestrator

Proof that survives an audit

A log that can be quietly edited proves nothing. Ours is a hash chain with signed checkpoints, and the verifier names what broke: tampering, insertion, deletion or truncation. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute run. With DataShield the next governed tool call is re-checked and fails closed. A gateway that checked the token at the door will keep letting that run finish. How Auth does it.

The data itself, already governed

Before an agent asks for a row, the column has been classified and the value tokenized. Joins still work. Names do not. That is a property of the dataset, so it holds no matter which tool or flow does the asking. See Ontology.

Where Prefect is genuinely stronger

Let us be blunt about the gap. Prefect has been at this since 2018, has 51.5k+ stars, and just bought its closest rival. FastMCP is theirs, it is downloaded over a million times a day, and it sits under about 70% of MCP servers written in any language. The high-level Python API they wrote went into the official MCP SDK in 2024. We ship MCP tools; they ship the thing most people build MCP tools with. They also hold a SOC 2 Type II report, publish a trust centre, and offer SCIM. We hold none of those. If your shortlist is scored on certifications this quarter, they win that column and you should say so out loud.

Here is the push-back, and it is narrow on purpose. Horizon governs the pipe. It decides which people and which agents may call which MCP tool, using your IdP and tool-level RBAC. That is good work and it is not what we do. But once a call is allowed, Horizon has no view of what the tool hands back. It does not know that column 14 is an MRN. It cannot tokenize a value, it cannot crypto-shred a subject, and its audit log is a log: useful to read, not something you can hand an examiner as proof it was never edited. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks. Those are exactly the calls a gateway waves through, because the caller was allowed.

Questions worth asking both of us

These are the questions we would want answered if we were buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and the verifier tells deletion apart from truncation and from tampering. Run it on a sample chain at /verify. Prefect: Horizon keeps audit logs per MCP server, and Enterprise plans set custom retention. We found no tamper-evidence mechanism in their public material. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call and the context drops to anonymous. Prefect Horizon reads your SSO session and evaluates policy per tool, which is closer to the right shape than most. We could not find a published answer on how fast a revoked session stops working. Ask how long a pulled agent keeps running.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Prefect states it is GDPR compliant and lets you set retention windows. The mechanism behind a deletion request is not described. Ask for the mechanism, not the policy page.

Do we drop Prefect if we buy DataShield?

No. You still need something to run the job at 03:00 and retry it at 03:04. We have no scheduler and no plans to build one. Run Prefect for the pipelines and run us for the datasets those pipelines produce, where the obligation is classification, authority and proof. Plenty of teams will pay both of us, and that is fine.

Prefect Horizon is an MCP gateway. Isn't that your job?

Part of it, and they do their part well. Horizon decides who may call a tool. We decide what the tool may return, and we keep the evidence. Ask both of us the same question: when an agent calls a tool that returns 4,000 patient rows, which layer knew those rows held PHI, and which layer can prove the answer a year later? For us it is the dataset, tokenized at ingest. For a gateway it is whatever the backing server chose to send.

Should the Dagster deal worry us?

Probably not this year. Prefect says deployments, contracts, pricing and support are unchanged, and Dagster keeps its name and licence. Still, two orchestrators under one roof usually converge in the end. Ask for the roadmap in writing, ask which product gets the next three hires, and ask what happens to Dagster+ pricing at renewal. That is a fair question to any acquirer, including a friendly one.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. Prefect does, and has a trust centre where you can get the report. What we offer instead is a public threat model, a verifier anyone can run, and design-partner terms that include source escrow, so a small vendor is not a single point of failure. Guardian and Lighthouse have been in production since April 2026. Details on the security page.

Prefect acquired Dagster Labs, announced 13 July 2026; the combined entity operates under the Prefect name from August 2026, and Dagster keeps its name and open-source licence. — dagster.io, 13 Jul 2026
Prefect's tagline: "Durable orchestration for data, ML, and agents," with hero line "Start with one flow. Scale to millions." and 51.5k+ GitHub stars. — prefect.io, 13 Sep 2026
Prefect Horizon is positioned as an "MCP gateway and governance for enterprise agents," with OAuth 2.1, tool-level RBAC, audit logs, a server registry, and 65+ identity providers. — prefect.io/horizon, 13 Sep 2026
FastMCP, maintained by Prefect, is downloaded over a million times a day and powers roughly 70% of MCP servers across all languages. — gofastmcp.com, 13 Sep 2026
Prefect Cloud pricing: Hobby free, Starter $100/month, Team $100 per user/month for 4 to 8 users, Enterprise custom, with SSO, RBAC, SCIM directory sync and IP allowlisting at Enterprise. — prefect.io/pricing, 13 Sep 2026
Prefect states it is "SOC 2 Type II certified," "GDPR compliant" and "HIPAA ready," with the report available through its trust centre. — prefect.io/security, 13 Sep 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →