Head-to-head · updated 13 September 2026
DataShield vs Snowflake Horizon: who governs the agent once the data leaves Snowflake?
Snowflake Horizon Catalog is the governance layer built into Snowflake. Its own page puts it plainly: "Govern and find data and AI assets across Snowflake and external catalogs." You get sensitive data classification, tag-based masking, row access policies, column-level lineage, a Trust Center, and since June 2026 an Agent Identity feature that checks an agent before it touches data. None of it is a line item. If your data lives in Snowflake, Horizon is already on, and it is good.
We are not a Snowflake feature. DataShield is a self-hosted data plane and control plane for agents, and it works the same whether the data sits in Snowflake, Postgres, or a Parquet file on your own disk. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is re-checked against the agent's current authority, and every decision is sealed into a hash chain you can verify without trusting us. Most people reading this will run both. Below is the honest split, including the rows Horizon wins.
The short version
Pick DataShield when
- Someone will ask you to prove an agent's access log was not edited. An auditor, a regulator, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
- The reader is an agent, not a trusted analyst. Masking hands the clear value to an authorized role. Tokens do not, and the vault sits outside the query path.
- Your estate is not one platform. Half the sensitive data is in Snowflake and the rest is in Postgres, S3, or a vendor SaaS app you inherited.
- You want the policy engine, the vault, and the evidence to run on your infrastructure, on keys you hold, under a price you can read on a web page.
Pick Snowflake Horizon when
- Everything that matters already lives in Snowflake. Then Horizon is the cheapest governance you will ever deploy, because there is nothing to deploy.
- You want classification, masking, row access policies, and column-level lineage to apply with no connector, no agent, and no second system to keep in sync.
- Your users want a semantic layer. Horizon Context, Semantic Studio, and Semantic View Autopilot are real work, and we ship nothing like them.
- You need SOC 2, ISO 27001, HIPAA, PCI, and FedRAMP on the platform itself, today, with a procurement path through all three cloud marketplaces.
Bottom line: Horizon governs Snowflake, and it does that well. We govern what an agent may do with data anywhere, and we keep proof of every decision. If Snowflake is your whole world, start with Horizon. If agents are already in production and your estate is mixed, the proof problem and the reader-trust problem both bite first.
Feature by feature
Competitor cells describe what Snowflake's public site, docs, and press releases say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Snowflake Horizon | Edge |
|---|---|---|---|
| Catalog and classification | We scan, profile, and classify a live PostgreSQL source in place, with no rows leaving it. Columns are labelled against 129 field classes covering PII, PHI, financial data, and secrets, with checksum validators and a reproducible verdict stamped with a config digest. That is PostgreSQL today, not your whole estate: Snowflake, BigQuery, Databricks, and S3 are declared on our roadmap with no handler yet. | Native, zero-integration classification across the account. Two tiers of tag: a semantic category, plus a privacy category of IDENTIFIER, QUASI_IDENTIFIER, or SENSITIVE. An AI mode adds LLM-assisted categories. Docs publish no class count, and AI mode skips tables with 300 or more columns. | ◇ |
| Data handling and tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade, or age band; ZIPs to 3 or 4 digits; partial phones, SSNs, and emails) with a measured cardinality-reduction score per column. Detokenization is admin-tier, tenant-scoped, and refused if the audit write fails. | Tag-based dynamic masking and row access policies, applied at query runtime by role. The plaintext stays in the table and comes back in full to an authorized role. Good for a trusted human, weak against a reader you cannot trust. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the failure: tampering, insertion, deletion, or truncation. Try the verifier. | Agent Identity keeps "complete audit trails of agent activity," and the Cortex AI Gateway adds end-to-end records across agents. We found no published cryptographic tamper evidence. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier, a metering guard, and a revocation re-check before dispatch. The call fails closed. | Agent Identity verifies the agent before data access and applies role-based permissions. Managed MCP tools run as the connecting role under RBAC, with read-only on by default for SQL execution. The unit of authority is the role, not the call. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, admin and IP-allowlist gated, auto-revoking, and impossible to quietly remove from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, cited to ISO/IEC 27040 and Article 17, plus ISO 27560 consent receipts. The audit chain still verifies afterwards. | Not described as a Horizon capability in the material we reviewed. Snowflake supports deletes and time travel, which is a different thing from destroying key material. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus, and Lighthouse. MCP tool tokens with scope ceilings, RFC 8693 delegation with an enforced ceiling, and per-call metering attributed to the agent. | A managed MCP server, GA since November 2025, with five tool types and a 50-tool cap per server. The July 2026 Cortex AI Gateway governs agent connections across more than 100 MCP servers, helped along by the Natoma acquisition. | ◈ |
| Lineage and semantics | Typed lineage traversal with per-hop access gating, derived from the pipelines that own the relationships rather than a stored column graph. A business glossary materialized from entity types. No semantic layer, no BI metadata harvest. | Column-level lineage, now fed by the Select Star acquisition, plus Horizon Context, Semantic Studio, and Semantic View Autopilot. This is the part of Horizon we admire most. | ◇ |
| Reach beyond the platform | Self-hosted and platform-agnostic. The same tokens, policy, and chain apply to any dataset we ingest, on any cloud, with no vendor account required. | Horizon Catalog is powered by Apache Polaris and reaches external Iceberg data through the Iceberg REST and Scan APIs. Real and open, but the policy authoring and the catalog itself still live in a Snowflake account. | ◆ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus, and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS. | SaaS only, on AWS, Azure, or GCP, in a lot of regions. Excellent if you want zero operations. Not an option if the rule says the data and the keys stay on your side. | ◈ |
| Maturity signals | Auth, Guardian, and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Public company, thousands of enterprise customers, SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, and FedRAMP at the platform level. We cannot match any of that. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | No Horizon SKU and no Horizon price. Governance work bills as consumption: classification runs on serverless credits, AI mode adds LLM token charges, and classifying views costs more than classifying tables. | ◆ |
◆ DataShield leads◇ Snowflake Horizon leads◈ comparable
Snowflake claims are drawn from snowflake.com, docs.snowflake.com, and Snowflake's own press releases, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a warehouse-native catalog
Proof that leaves with you
Horizon's audit trail lives in the account that also bills your compute. Ours is a hash chain with signed checkpoints, and the verifier says what broke, not just that something did. It keeps verifying after you export it, after you migrate, and in front of an auditor who does not have a Snowflake login. Try it in your browser, no signup.
A token the agent cannot resolve
Masking is a display-time control. An authorized role still gets the real SSN back, and an agent under a service role is an authorized role. We take the value out of the dataset at ingest and park the vault outside the query path. A hijacked agent finds surrogates. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. Not at the next token refresh. The next call. How Auth does it.
Where Snowflake Horizon is genuinely stronger
Let us be fair about the thing we are up against. Horizon is free, it is already switched on, and it needs no connector. Classification, tag-based masking, row access policies, and column-level lineage all apply to data that is already sitting there, which is a shape of value no standalone tool can copy. The June 2026 Summit release added Horizon Context, Semantic Studio, and Semantic View Autopilot, and a semantic layer that maintains itself is hard, useful work. They bought Select Star in November 2025 and folded its lineage and discovery straight into the catalog. They bought Natoma in May 2026 and turned it into a gateway that governs agent connections across more than 100 MCP servers. Add SOC 2, ISO, HIPAA, PCI, and FedRAMP at the platform level, and you have a story we cannot answer with a roadmap. If your whole estate is Snowflake, buying anything else for governance needs a real reason.
Here is the reason. Every control Horizon gives you is expressed in Snowflake's RBAC and stored in Snowflake's account. That is fine until three things happen at once. Your data is not all in Snowflake, so half the estate is governed by a different model or by nothing. Your reader is an agent rather than a trusted analyst, and masking is designed to return the clear value to an authorized role. And an examiner asks you to show that the March agent logs were not altered, which is a question about cryptography, not about whether a log exists. Snowflake's own July 2026 release leans on identity partners such as Okta, SailPoint, and Aembit for task-scoped agent access, which tells you where they think the seam is. We think the seam is one layer lower: the data the agent can reach, and the evidence of what it did with it.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and the verdict tells deletion apart from truncation and from tampering. Try it on a sample chain at /verify. Snowflake: Horizon's Agent Identity promises complete audit trails, and the Cortex AI Gateway records agent activity end to end. We found no published tamper-evidence mechanism. Ask them to show one, and ask who can write to the table.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the very next call and the context drops to anonymous. Snowflake evaluates RBAC as the connecting role, and a revoked grant will stop new work, but we could not find published mid-session revocation semantics for an in-flight Cortex Agent or MCP session. Ask how long a compromised agent keeps working after you pull its access.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Snowflake gives you deletes, time travel, and retention settings, which is not the same as destroying the key that makes a value readable. Ask for the mechanism, not the workflow.
We're all-in on Snowflake. Do we drop Horizon?
No. That would be a silly thing for us to suggest and a worse thing for you to do. Horizon is on, it costs nothing extra to have, and its classification and masking are the right controls for human analysts. Run it. Add us where the reader is an agent, where the data has to leave Snowflake to reach one, or where you need evidence that still verifies outside the account. Plenty of teams will sensibly run both.
Horizon now has Agent Identity and a Cortex AI Gateway. What is left for you?
Three things. Horizon verifies an agent's identity and then hands it the role's grants; we cap each individual call at a scope ceiling and re-check authority before dispatch. Horizon's masking returns the clear value to an authorized role; our tokens do not resolve in the query path at all. And Horizon's trail is a log inside the platform; ours is a chain anyone can verify. There is also a plainer point. Their gateway governs agents reaching Snowflake. It does not govern the agent reaching your Postgres, your S3 bucket, or your vendor's API.
Do you connect to Snowflake as a data source today?
Not as a catalog provider. Our in-place scan and profile is GA for PostgreSQL only, and Snowflake, BigQuery, Databricks, and S3 are declared with no handler built yet. We would rather tell you that than let you find out in week three. What does work today: ingest the data you want agents to touch, tokenize it at ingest, and serve it over MCP under Auth. Credentials for upstream systems sit in the Connection Vault under one of eight strategies, encrypted at rest and never readable back.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Snowflake has SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, and FedRAMP, and that is a genuine gap. What we offer instead is a published threat model, a verifier anyone can run, and design-partner terms that include source escrow so a small vendor is not a single point of failure. Details on the security page.
- Horizon Catalog's own positioning: "Govern and find data and AI assets across Snowflake and external catalogs. Enterprise context, lineage, data quality monitoring and AI guardrails mean every answer is traceable and trusted." — snowflake.com, 13 Sep 2026
- Summit 2026 added Horizon Context, Semantic View Autopilot, Trust Center enhancements, and Agent Identity: verified identity for agents before data access, role-based permissions, and audit trails of agent activity. — Snowflake press release, 2 Jun 2026
- Cortex AI Gateway governs first- and third-party agents across more than 100 MCP servers, with end-to-end audit trails, and names 1Password, Aembit, Okta, SailPoint, and Saviynt as task-scoped access partners. — Snowflake press release, 28 Jul 2026
- Horizon Catalog is powered by Apache Polaris, with Iceberg v3 support and bi-directional external-engine read and write to "a single, live, governed copy" of the data. — Snowflake press release, 2 Jun 2026
- Sensitive data classification tags columns with a semantic category and a privacy category (IDENTIFIER, QUASI_IDENTIFIER, SENSITIVE), bills as serverless credits, and adds LLM token charges in AI mode. — docs.snowflake.com, 13 Sep 2026
- The Snowflake managed MCP server exposes five tool types, caps a server at 50 tools, and defaults SQL execution to read-only, with authorization by RBAC as the connecting role. — docs.snowflake.com, 13 Sep 2026
Other head-to-heads
DataShield vs Unity Catalog
The same argument, one lakehouse over.
Platform catalogDataShield vs Microsoft Purview
Estate-wide labels, versus authority at the tool call.
CatalogDataShield vs Select Star
The catalog Snowflake bought, and what it still doesn't enforce.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your warehouse still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →