Head-to-head · updated 13 September 2026
DataShield vs Soda: your checks pass, but can you prove what the agent did?
Soda is a data quality platform, and a good one. You write checks in YAML, run them in your own pipeline with Soda Core, and Soda Cloud collects the results. Their hero line is "Stop data incidents before they hit production," which is a fair description of the product rather than a slogan. There is a real free tier, a $750 a month team tier printed on the page, and an MCP server that already ships 65 tools. They publish research in NeurIPS and JAIR. We are not going to pretend our rules engine beats theirs, because we do not have one.
We answer the next question. Is this data safe to hand an agent, and can you prove what the agent did with it? Ontology profiles and classifies the datasets. Auth decides what an agent may do with them and re-checks that on every governed tool call. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Here is the honest split, including the rows Soda wins.
The short version
Pick DataShield when
- Agents are already reading customer tables and someone in legal has started asking what they read. We re-check authority on every governed tool call and seal the decision into a hash chain. Run the verifier.
- You need the columns classified before anything moves. 129 field classes, including all 18 HIPAA Safe Harbor identifiers, decided by regex, checksum and column-name evidence rather than a model. How the catalog works.
- An analyst leaves on a Friday and their agent is 20 minutes into a 40-minute job. You want the next call to fail, not the next token refresh. How Auth does it.
- The control plane has to run on your own infrastructure, on keys you hold, with no metadata leaving the building.
Pick Soda when
- The job is data quality. Checks, thresholds, freshness, volume, schema drift. Soda Core has 50-plus built-in check types and runs in your own Airflow or dbt job. We ship none of that.
- You want data contracts as the organising idea, enforced at the pipeline boundary, with a copilot that drafts them for you.
- You need anomaly detection and incident workflow. Their monitors, record-level anomaly detection and Slack or Jira routing are a product. Ours do not exist.
- You want to start today for nothing. Free tier, no credit card, unlimited users, and $750 a month when you outgrow it.
Bottom line: Soda tells you whether the data is fit to use. We decide whether an agent may use it and keep proof of the decision. Plenty of teams should run both, and the ones who run both usually bought Soda first.
Feature by feature
Competitor cells describe what Soda's public site and docs say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Soda | Edge |
|---|---|---|---|
| Data quality checks | None. We profile and score datasets, we do not test them against your rules. There is no check language here, no freshness SLA and no volume threshold. | The core product and the best part of it. SodaCL-style YAML checks, 50-plus built-in types, data contracts, and a CLI that runs in the pipeline you already have. | ◇ |
| Anomaly detection and incidents | Not built. We have change and drift detection on datasets, plus a diff engine and a schema-evolution tracker. That is not the same thing and we will not dress it up. | Monitors, record-level anomaly detection, incident management, and routing into Slack, Jira or ServiceNow. They claim 70% fewer false positives than a Prophet baseline. | ◇ |
| Profiling and trust scoring | Every dataset gets a 20-section analysis profile: completeness, field statistics, patterns, column semantics, relationship graph, quality metrics, lineage and compliance governance. A weighted composite trust KPI rolls up per entity type, domain and estate, and recomputes hourly. | Profiling, dashboards and quality scores in Soda Cloud, driven by the checks you write. | ◈ |
| PII and PHI classification | 129 field classes covering PII, PHI, financial data and secrets, with all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. Regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), column-name lexicons and anti-pattern suppressors. No model, so the verdict is reproducible from a config digest. Shipped, and shipped recently. | Column attributes and a guide on managing sensitive data. We found no built-in sensitive-data classifier in their docs. | ◆ |
| Raw row handling | Catalog scans store no column values by default. Storing plaintext samples needs an explicit acknowledgement and writes an audit row. We scan and profile a live PostgreSQL source in place with no row egress. That is PostgreSQL today, not your whole estate. | Soda AI works from schema and metadata, "never your raw rows or PII." Failed row samples are different: Soda collects a sample of failing rows and, by default, stores it in Soda Cloud. You can switch that off per dataset or send it to your own Diagnostics Warehouse. We found no per-column masking of those samples. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Detokenization is privileged, tenant-scoped and logged. | Not a thing they do. Nothing in their docs suggests they claim to. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns a three-valued verdict and names the failure: tampering, insertion, deletion or truncation. Try the verifier. | Audit logs are listed as a Team tier feature. We found no description of a tamper-evidence mechanism. Ask them whether the log is hash-chained or just a table. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a revocation re-check before dispatch, then gets metered and attributed to the agent. It fails closed. | Their MCP server authenticates with a Soda Cloud API key ID and secret from environment variables. The docs say some tools modify resources or trigger scans, and advise you to review the proposed call before approving it. That approval lives in the MCP client, not on the server. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, admin and IP gated, step-up authenticated, and fully audited. It auto-revokes and cannot be quietly deleted from the log. | Not described in their public docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. | Not described. A quality platform holding failed row samples has a real erasure question to answer, so ask it. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse, over the governed data itself. Tool tokens carry scope ceilings and delegation is RFC 8693 token exchange with an enforced ceiling. | 65 MCP tools, 26 read and 39 write or trigger, across datasets, checks, contracts, monitors, runners and secrets. A genuine agent surface, shipped, and better documented than most. | ◈ |
| Identity and provisioning | SAML, OIDC, OAuth 2.1, WebAuthn passkeys, RFC 9068 tokens with JWKS rotation, and a Connection Vault with eight credential strategies. No SCIM endpoint exists. We would rather say that than fudge it. | SSO, global and dataset roles, service accounts bound to runners, and SCIM provisioning with Microsoft Entra ID. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS. | Soda Core runs in your pipeline and a self-hosted Runner deploys into your own Kubernetes, where "data stays within your network." The control plane is Soda's multi-tenant SaaS unless you buy private deployment at Team tier or above. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Chicago and Brussels offices, an open-source engine with 2.4k GitHub stars, a decade of category presence, published research and a customer logo wall. Funding and founding details are not on their site. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Free at $0, Team at $750 a month, Enterprise on request. Usage is metered in Soda Processing Units. One of the more honest pricing pages in this market. | ◈ |
◆ DataShield leads◇ Soda leads◈ comparable
Soda claims are drawn from soda.io, docs.soda.io and the sodadata/soda-core repository, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a data quality platform
Proof that survives an audit
A log that can be silently edited proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
Classification before the data moves
A check tells you a column is 4% null. It does not tell you the column is a medical record number. We label columns against 129 classes with checksums and lexicons, then let the masking and tokenization rules hang off that label. See the catalog.
Authority that can change mid-flight
Revoke an agent and the next governed tool call fails closed, because authority is re-read on every call. Not on the next token refresh. A quality platform will still happily run its scheduled scan. How Auth does it.
Where Soda is genuinely stronger
Soda does the thing we do not do. Soda Core is a real open-source engine with a large installed base, it runs where your pipeline already runs, and it speaks the language data engineers actually use: checks, contracts, thresholds. Soda Cloud turns that into monitors, incidents and dashboards, and the anomaly work behind it is published research rather than a marketing number. Their pricing page has prices on it. Their MCP docs are clearer than most vendors manage, and they tell you outright that some tools write and that you should read the proposed call before you approve it. They also ship SCIM, which we do not.
Here is the push-back, and it is narrow. Their approval gate lives in the MCP client. The server authenticates with an API key ID and secret sitting in environment variables, and we found no scope ceiling, no mid-session revocation and no per-agent attribution in the docs. Thirty-nine of those 65 tools write, trigger or delete, including tools that manage secrets. If a model on a bad day proposes a data source deletion at 2am and a tired engineer clicks approve, the system that has to answer for it is the one holding the log. That is a different layer from data quality, and it is the layer we sell.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Try it on a sample chain at /verify. Soda: audit logs appear as a Team tier feature. We found no tamper-evidence mechanism described anywhere in their public docs. Ask them whether the log is hash-chained, and who can edit the table.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the very next call and the context drops to anonymous. Soda's MCP server loads Soda Cloud credentials from environment variables at startup. We could not find a mid-session revocation path in their docs. Ask how long a revoked key keeps working, and whether an already-running scan stops.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the chain still verifies after the subject is gone. Soda does not describe an erasure mechanism. The question matters more for them than it looks, because failed row samples can put real customer rows in Soda Cloud. Ask what happens to those rows on an erasure request.
Is DataShield a data quality tool? Do we drop Soda?
No, and no. We have no check language, no monitors, no freshness SLAs and no incident management. If your problem is a broken pipeline at 3am, buy Soda. Run us for the datasets agents actually touch, where the obligation is classification, authorization and evidence. Most teams who buy us already own something like Soda, and the two do not fight.
Soda's MCP server is metadata-only. Isn't that safer than yours?
It is a sound design for a quality tool, and their blog says the AI layer works from schema and metadata, "never your raw rows or PII." But read their tools page: 65 tools, 39 of them write or trigger, including scan triggers and secrets management. Metadata-only is about what the agent reads, not about what it can change. Our answer is different: agents do query governed data, so every call carries a scope ceiling, gets authorized before dispatch, and is sealed into the chain. Ask both of us to show the enforcement point, not the intent.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page. We found no SOC 2 or ISO 27001 statement on Soda's public pages either, so ask them too.
- Soda's hero: "Stop data incidents before they hit production." Record-level anomaly detection, "70% fewer false positives" against a Prophet baseline, and published research in NeurIPS, JAIR and ACML. — soda.io homepage, 13 Sep 2026
- Published pricing: Free at $0 a month with pay-as-you-go Soda Processing Units, Team at $750 a month with SSO, RBAC, audit logs and private deployment, Enterprise on request. — soda.io/pricing, 13 Sep 2026
- "Soda AI works from your schema, metadata, and contracts, never your raw rows or PII," with a propose-then-approve flow: "it drafts a contract or suggests a fix, and you approve the change before anything takes effect." — Soda blog, CLI vs API vs MCP, 3 Jul 2026
- Soda MCP exposes 65 tools, 26 read and 39 write or trigger, across datasets, checks, contracts, monitors, data sources, runners and secrets. — docs.soda.io, Soda MCP tools, 13 Sep 2026
- Soda MCP authenticates with SODA_API_KEY_ID and SODA_API_KEY_SECRET from environment variables, and the docs advise reviewing "the client's proposed tool call before approving write, delete, or trigger actions." — docs.soda.io, Soda MCP, 13 Sep 2026
- "Soda automatically collects a sample of the failing rows" and by default stores that subset of monitored data in Soda Cloud; it can be disabled per data source or redirected to a customer-owned Diagnostics Warehouse. — docs.soda.io, failed row samples, 13 Sep 2026
- Soda Core describes itself as the "Data Contracts engine for the modern data stack," with 2.4k GitHub stars and connectors for PostgreSQL, Snowflake, BigQuery, Databricks, DuckDB, Redshift, Trino, Spark, SQL Server, Fabric and Athena. — github.com/sodadata/soda-core, 13 Sep 2026
Other head-to-heads
DataShield vs Great Expectations
The other rules engine, and the governance it leaves to you.
ObservabilityDataShield vs Monte Carlo
Watching pipelines, versus governing what agents read.
Open sourceDataShield vs OpenMetadata
Self-hosted cataloguing, plus the enforcement layer it lacks.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your quality checks still owe you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →