Head-to-head · updated 13 September 2026
DataShield vs Starburst: your agent can reach the data, but may it?
Starburst is the company behind Trino, and it shows. Point Starburst Galaxy at a warehouse, an Iceberg lake, a Postgres box and an S3 bucket, and you can join across all of them in one query. No pipeline first. Their hero line is "Stop moving data. Start using it." That is a real engineering position, held for years, and the logo wall backs it up. On top sits AIDA, their natural-language agent, plus a hosted MCP server for other people's agents. The MCP work is careful, too: OAuth 2.1, the agent inherits the logged-in user's permissions, and any statement that writes is rejected at parse time before a cluster sees it.
We do not write a query engine, and we are not going to pretend we federate your estate. DataShield governs the datasets agents read. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Fields get classified against 129 built-in PII, PHI, financial and secret classes. Every governed tool call is checked against the agent's current authority before it runs, and the decision is sealed into a hash chain you can verify yourself. Starburst answers whether an agent can reach the data. We answer whether it may, and whether you can prove that in a year.
The short version
Pick DataShield when
- The values themselves are the problem. We tokenize at ingest, so an agent joins on a token and never reads the SSN behind it. How the data plane works.
- Someone will ask you to prove an agent's access log was not edited. An examiner, an auditor, or Article 12 of the EU AI Act. Our chain answers with math. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
- You want a price before you book a call, and no per-credit meter running while an agent thinks.
Pick Starburst when
- Your data lives in eight systems and moving it is not on the table. Federated SQL is the whole point of the company, and they are very good at it.
- You are building an open lakehouse on Iceberg. Their Icehouse work, table maintenance and Warp Speed caching are years ahead of anything we would attempt.
- Analysts want to ask questions in English and get charts back. AIDA is aimed squarely at that, and Skills let your own team teach it domain tricks.
- You already run Trino and want the commercial version, with ABAC, SCIM and a support contract attached.
Bottom line: Starburst decides which tables an agent may query. DataShield decides what the agent may do with the values inside them, and keeps proof of the decision. Teams with agents already touching regulated data usually meet the second question when the auditor arrives.
Feature by feature
Competitor cells describe what Starburst's public site and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Starburst | Edge |
|---|---|---|---|
| Federated query across systems | Not our job. We ingest datasets into a governed plane, and our catalog scans a live PostgreSQL source in place. Snowflake, BigQuery, Databricks, S3 and Salesforce are declared on the roadmap with no handler yet. | The product. Dozens of connectors, cross-system joins, no data movement, proven at large scale. Warp Speed caching and Iceberg table maintenance on top. | ◇ |
| Field-level PII and PHI classification | 129 built-in classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. Regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), column-name lexicons and anti-pattern suppressors. No model, so verdicts are reproducible from a config digest. | Column masking and row filtering at query time, driven by policies you write. We found no built-in sensitive-field classifier in their public material. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest. Plus quasi-identifier generalization: dates to year, decade or age band, ZIPs to 3 or 4 digits, partial phones, SSNs and emails, with a measured cardinality-reduction score per column. | Masking hides a value from a viewer. It is not reversible under policy, and it is not vocabulary they use. Nothing we found tokenizes before a model reads the result. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage, or tampered, and names the failure: tampering, insertion, deletion or truncation. Try the verifier. | Every MCP operation lands in the Galaxy audit log, tagged as an MCP query with the client user agent and a trace token. Good telemetry. We found no cryptographic tamper evidence over it. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a revocation re-check before dispatch. It fails closed. Delegation is RFC 8693 token exchange with an enforced scope ceiling. | The agent runs as the logged-in user, under Gravity RBAC and ABAC, read-only, with writes rejected at parse time. That is a sound design. It also means the agent's reach equals one person's reach, all session long. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. Admin plus IP allowlist plus step-up, auto-revoking, and it cannot be quietly removed from the log. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material, plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the audit still verifies after the subject is gone. | A query engine erases nothing. Deletion happens in the systems underneath, which is honest but leaves the obligation with you. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and every call is metered and attributed to the agent. | A hosted MCP server in Galaxy since April 2026. OAuth 2.1, no dynamic client registration on purpose, read-only enforcement, result-size limits. Narrow by design, and well built. | ◈ |
| Natural-language analytics | We have none. Agents query governed datasets over MCP and you bring your own model. | AIDA turns questions into SQL, cites evidence and builds dashboards. Skills let customers add domain capability in an open file format, run under the invoking user's permissions. Guardrails add four toggles, including prompt-injection defence and topic filtering. | ◇ |
| Prompt path | We do not proxy your LLM traffic. We do gate every value that leaves a governed dataset for a prompt, and a PHI dataset refuses an endpoint without a BAA. Local embeddings for RAG, so nothing leaves for a third party to vectorise. | Guardrails filter the agent's behaviour: instruction extraction, data-borne injection, prompt length, banned topics. Their own post calls it a behavioural layer above the structural controls. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian verifies. Ed25519 audit-signing keys can live in your KMS or HSM; HMAC tokenization keys sit in your environment today, not in a KMS. | Galaxy as SaaS, Starburst Enterprise self-managed and on-prem, AWS Marketplace, plus open-source Trino underneath if you want zero vendor at all. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. Field classification cut over from shadow mode days ago, which is new and we will not call it battle-tested. | Founded 2017, roughly $414M raised through a 2021 Series D, British Airways, Citi, Lockheed Martin and Optum on the logo wall, and a Dell alliance they say passed $100M in annual recurring revenue. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall, no per-query meter. | Published and clear: free tier, then $0.50, $0.75 and $1.00 per credit, with AIDA at the Enterprise tier and its tokens billed separately. Credit maths at agent volumes is on you. | ◈ |
◆ DataShield leads◇ Starburst leads◈ comparable
Starburst claims are drawn from starburst.io and the Starburst engineering blog, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a query engine
The value is already a token
Access control decides who sees a column. It does not change what the column holds. We tokenize at ingest, so an agent joins on TOK_9f2c... and the SSN stays in the vault. Reading it back is a separate, privileged, logged operation. See the data plane.
Authority that can change mid-flight
An analyst quits on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A session that inherits a user's permissions keeps going until something expires. How Auth does it.
Proof that survives an audit
An audit log you can edit proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers ask about. Try it in your browser, no signup.
Where Starburst is genuinely stronger
Let us be plain about the gap. Starburst has been building distributed SQL since 2017, claims 84% of Trino commits in 2024, and runs at a scale we have no business claiming. If your data sits in eight systems and the answer needs all eight, nothing in our stack helps and Starburst does it in one query. Their 2026 run has been fast: a hosted MCP server in April, AIDA in May, Skills in June, Guardrails in July, a Dell alliance they say passed $100M in annual recurring revenue in the same month. The MCP engineering post is the kind of writing that tells you grown-ups are involved. Read-only enforcement at parse time, no dynamic client registration, agents pinned to the logged-in user's permissions. We would have shipped it the same way.
Here is the push-back. Everything above is about reach: which tables, which rows, which columns. Once the query is allowed, the raw value goes to the model, the log that records it is an ordinary log, and the agent keeps the user's full access for the rest of the session. In September their own guest post argued agents should sit behind a virtualization layer, and listed the benefits as efficient joins, discovery and caching. All true, all about performance. Gartner expects most unauthorized agent actions through 2028 to be internal policy violations rather than attacks, and that is the case where an efficient join is no comfort at all. Classification, tokenization and evidence live at a different layer, and they sit on top of a federated engine perfectly happily.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Starburst: the Galaxy audit log records every MCP operation with source tags and trace tokens, which is good telemetry. We found no published tamper-evidence mechanism over it. Ask them how you would detect an edited row.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call. Starburst's hosted MCP pins the agent to the logged-in user's permissions, so in theory pulling that user's access pulls the agent's. Ask how quickly a live session notices, and what the token lifetime is. That number is the size of your window.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Starburst queries data in place and does not own it, so erasure stays with the source systems. That is a fair architecture, not a dodge. It does mean nobody hands you the proof that it happened.
Is DataShield a Starburst alternative for federated query?
No. If the job is "join across Snowflake, Iceberg and Postgres without copying", buy Starburst. We ingest and govern the datasets agents read, and our catalog covers PostgreSQL today, not your whole estate. Most buyers who talk to us about Starburst are running both: the engine answers the question, we decide what the agent may see and keep the record.
AIDA has Guardrails. Isn't that the same thing?
It is a different layer, and their own July 2026 post says as much: Guardrails is a behavioural layer above the structural controls. Four toggles: defend the agent against instruction extraction and injection hidden in data, hold the data-product boundary, cap prompt length, refuse listed topics. Useful, and we do none of it. What it does not do is change the values the model reads, or leave you an artefact an examiner can check. Ask for both.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth ships with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- Starburst's hero positioning: "Stop moving data. Start using it." with "100,000+ ETL pipelines eliminated" and "2.5x faster than Trino". — starburst.io, 13 Sep 2026
- Galaxy's hosted MCP server: OAuth 2.1 support, agents "only allowed to perform operations of the logged-in user", and any statement that modifies data "is rejected at parse time, before it ever reaches a Trino cluster". — Starburst blog, 9 Apr 2026
- AIDA Skills are authored by customers in the open agentskills.io format, are session-scoped, and execute their SQL under the invoking user's permissions. — Starburst blog, 12 Jun 2026
- Guardrails add four toggles (agent protection, data-product boundary, prompt limiting, topic filtering) as "a behavioral layer above the platform's existing structural protections". — Starburst blog, 7 Jul 2026
- Published Galaxy pricing: free tier, Pro $0.50 per credit, Enterprise $0.75 per credit with ABAC, SCIM, PrivateLink and AIDA (tokens billed separately), Mission-Critical $1.00 per credit. — starburst.io/pricing, 13 Sep 2026
- Starburst argues agents should query through a virtualization layer: "Data virtualization systems are able to perform joins of external datasets far more efficiently (and at lower cost) than modern agents." — Starburst blog, 11 Sep 2026
Other head-to-heads
DataShield vs Dremio
Query acceleration on the lake, versus authority at the tool call.
PlatformDataShield vs Databricks
One platform for everything, and the evidence layer it doesn't ship.
WarehouseDataShield vs Snowflake
Governance inside the warehouse, versus proof that travels.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then ask what your query engine still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →