Head-to-head · updated 13 September 2026
DataShield vs Select Star: the catalog knows the column, but who let the agent read it?
Select Star calls itself a "Metadata Context Platform for Data & AI", and the label fits. Point it at Snowflake, BigQuery, Databricks, dbt and your BI tools and it reads the query logs. Out comes column-level lineage, popularity stats, entity diagrams and AI-written docs, often inside a day. Their MCP server has been live since July 2025 and gives Claude or Cursor seven read-only tools for catalog context. On 24 November 2025 Snowflake announced it is buying them.
We are not a multi-warehouse lineage tool and we will not pretend to be. Ontology has a real catalog, but it scans live PostgreSQL today, not your whole estate. What we add sits one layer down. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's authority before it runs, and the decision is sealed into a hash chain you can verify yourself. Here is the honest split, rows they win included.
The short version
Pick DataShield when
- An examiner will one day ask you to prove an agent's access log was not edited. Our chain answers with math, not a policy PDF. Run the verifier.
- You need to cut an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
- The data, the policy engine and the evidence all have to stay inside your own perimeter, on keys you hold.
- Your agents do more than read metadata. They query governed data, and you need a record of who allowed it.
Pick Select Star when
- You want column-level lineage across Snowflake, BigQuery, Databricks, dbt, Looker, Tableau and Power BI. That is their core job and they are quick at it.
- Speed matters more than ceremony. Their pitch is metadata activation within 24 hours, and G2 gave them a Fastest Implementation badge.
- Your estate is Snowflake-centric. Post-acquisition their lineage folds into Horizon Catalog and feeds Snowflake Intelligence and Cortex Code.
- You want semantic models built from the BI definitions you already have, in the Open Semantic Interchange shape.
Bottom line: most teams should run both. Select Star tells an agent what a column means. DataShield decides whether that agent may read the values, and keeps proof of the call. The one place we do compete is the MCP seam: theirs hands out context under a bearer key, ours hands out governed data under a scope ceiling.
Feature by feature
Competitor cells describe what Select Star's public site and docs say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Select Star | Edge |
|---|---|---|---|
| Catalog breadth and lineage | We register a live PostgreSQL source as a catalog provider, scan it, and profile assets and columns in place. No rows leave the source. Snowflake, BigQuery, Databricks, S3 and Salesforce are declared on the roadmap with no handler yet. Lineage is a typed edge graph with access gating at every hop, derived from the pipelines that own the data rather than parsed from query logs. | The strong suit. Query-log parsing gives column-level lineage across the warehouse and BI layer, plus dbt impact analysis and auto-drawn entity diagrams. | ◇ |
| Field classification | 129 built-in field classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers. Regex plus checksum validators, column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. The kernel went live this month, so it is new, not battle-worn. | There is no classification engine. You tag a column as PII yourself, and Select Star then scrubs matching values out of stored query logs. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the break. Try the verifier. | SOC 2 controls mention audit logging. We found no tamper-evident or verifiable log for agent access in their public docs. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a fresh revocation check before dispatch. It fails closed. | The MCP server authenticates with a bearer API token. Their docs describe no per-agent scoping of what that token may see. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Agents read governed data, not just metadata, and every call is metered and attributed to the agent. | A real hosted MCP server since 17 July 2025, with seven read-only tools for search, asset detail, lineage traversal and semantic models. Good context. It does not run the query. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and cannot be quietly removed from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. The audit chain still verifies afterwards. | Customer data is deleted on request or at termination within up to 10 business days. That is a retention promise, not an erasure mechanism. | ◆ |
| Tokenization and masking | Deterministic, join-preserving, vault-reversible tokens at ingest, plus quasi-identifier generalization: dates to year, decade or age band, ZIPs to 3 or 4 digits, partial phones, SSNs and emails, with a measured cardinality-reduction score per column. These are features you switch on, not defaults. Detokenization is admin-tier, tenant-scoped and logged. | None. By design they hold metadata and query logs, and say they will never access your data values unless you explicitly authorize it. | ◆ |
| Semantic models for AI | We materialize a business glossary from entity types and expose golden records behind masked views. We do not generate BI semantic models. | Semantic Model Generation turns Looker, Tableau, Power BI and dbt definitions into governed models. Founding member of Open Semantic Interchange, September 2025. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. Ed25519 audit-signing keys can live in your own KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS, and we say so. | Multi-tenant SaaS on AWS. No self-hosted or on-premise option is documented. | ◆ |
| Maturity signals | Live in production, with Guardian and Lighthouse running since April 2026. SOC 2 not yet certified, and we say so. | Founded 2020, about $20M raised, SOC 2 Type II every year since May 2021, roughly 20 named logos, and now a Snowflake acquisition behind them. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Their pricing page shows no numbers. Capterra lists a $300 per month starting price, and marketplace listings say the basis is sources, users and tables. Expect repackaging into Snowflake consumption. | ◆ |
◆ DataShield leads◇ Select Star leads◈ comparable
Select Star claims are drawn from selectstar.com, docs.selectstar.com and their own posts, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a metadata catalog
Proof that survives an audit
A log that can be quietly edited proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A bearer API key in a config file does not know anyone resigned. How Auth does it.
A catalog an agent can act on safely
Ontology's catalog stores no column values by default. Storing a plaintext sample takes an explicit acknowledgement and writes an audit row. Lineage traversal checks access at both ends of every hop, so an agent cannot walk the graph into data it may not see. See the catalog.
Where Select Star is genuinely stronger
Let us be blunt about the gap. Their connector list is long and ours is one database. They parse warehouse query logs to build column-level lineage across Snowflake, BigQuery, Databricks, dbt and three BI tools, and they do it fast enough to claim activation within 24 hours. We are not going to catch that coverage this year, or next. Their semantic-model work is credible too, and being a founding member of Open Semantic Interchange puts them in the room where that format gets decided. They have held SOC 2 Type II since May 2021 with no exceptions. We do not have SOC 2 at all yet. Their metadata-only posture is a real security virtue: a vendor that never reads your values cannot leak them.
Now the push-back, and it is the same fact read the other way. A tool that never touches values cannot find the SSN nobody tagged, cannot mask it, and cannot tell you which agent read it. Their MCP server is a bearer token pointed at the whole catalog. The docs say nothing about scoping one agent away from another, and nothing about a verifiable record of what each agent pulled. Then there is the roadmap question. Snowflake announced the deal on 24 November 2025, lineage and discovery are heading into Horizon Catalog, and the post promises to expand the context layer beyond Snowflake without saying what standalone pricing looks like next year. If you run Databricks, that is a fair thing to ask them on the call.
Questions worth asking both of us
These are the questions we would want answered if we were buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it on a sample chain at /verify. Select Star: their security page lists audit logging among SOC 2 controls. We found no tamper-evidence mechanism in their public docs. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call. Select Star's MCP server uses a bearer API token, and their docs do not describe session revocation. Ask how long a rotated token keeps working, and who can rotate it at 2am.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Select Star deletes customer data on request within up to 10 business days. That covers the account, not a single data subject inside it. Ask for the mechanism, not the timeline.
Is DataShield a data catalog? Do we drop Select Star?
We have a catalog, but no. Theirs covers your warehouse and BI stack; ours covers a live PostgreSQL source today. Most buyers keep their lineage and add our layer for the datasets agents actually query. If someone tells you one product does discovery, lineage, classification, tokenization, agent authorization and evidence across every system you own, ask for the demo and a stopwatch.
Snowflake is buying them. Does that matter?
It depends where your data sits. If you are all-in on Snowflake, this is good news: lineage folds into Horizon Catalog and feeds Snowflake Intelligence. If you run Databricks or BigQuery too, you now have a roadmap risk you did not have in 2024. We are independent and warehouse-agnostic, and we run inside your perimeter, which is the reason several buyers call us. Fair warning: independence is a promise from a small vendor, so ask us about source escrow.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Select Star does, annually since May 2021. What we offer instead is a published threat model, a verifier anyone can run, and Docker images you host yourself. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow. Details on the security page.
- Select Star's current positioning: "Metadata Context Platform for Data & AI" and "AI-ready data starts here." — selectstar.com, 13 Sep 2026
- Snowflake announced it is acquiring Select Star; lineage and discovery go into Horizon Catalog and power Snowflake Intelligence and Cortex Code. — Select Star blog, 24 Nov 2025
- The hosted MCP server exposes seven read-only metadata tools and authenticates with a bearer API token; no per-agent scoping or audit mechanism is documented. — docs.selectstar.com, 13 Sep 2026
- MCP server launched for AI code editors and agents, giving them catalog and lineage context. — Select Star blog, 17 Jul 2025
- SaaS on AWS only, SOC 2 Type II annually since May 2021, metadata and query logs by default, customer data deleted within up to 10 business days. — Select Star security and compliance, 13 Sep 2026
- Semantic Model Generation and Open Semantic Interchange founding membership: BI definitions turned into AI-ready semantic models. — Select Star blog, 23 Sep 2025
Other head-to-heads
DataShield vs Snowflake Horizon
Governance inside one platform, versus evidence across all of them.
CatalogDataShield vs Atlan
Active metadata for humans, versus authority for agents.
CatalogDataShield vs Secoda
Fast AI-native search, and the enforcement layer under it.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your catalog still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →