Head-to-head · updated 13 September 2026
DataShield vs Strac: a filter in the tool call, or an identity plane behind it?
Strac is the closest thing to a real competitor we have, and I'd rather say that up front than pretend otherwise. Their MCP gateway genuinely sits in the live tool-call path and redacts PII, PHI, card data, secrets, and source code before the model sees them. They ship a Claude DLP product covering Claude Chat, Desktop, Code, Cowork, and MCP connectors. They have SOC 2, ISO 27001, HIPAA, PCI, and logos like UiPath. We have none of that, and no inline interceptor at all.
DataShield works the other way round. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. On top of that sits the part a filter can't do: we issue the agent's token, cap its scope, re-check its authority on every governed tool call, and seal each decision into a hash chain you can verify without trusting us. Below is where that difference actually bites.
The short version
Pick DataShield when
- You want to be the issuer of agent identity, not an observer of it. Auth mints MCP tool tokens with scope ceilings and authority tiers, rotates JWKS, and keeps a services registry. How Auth does it.
- You need an agent's authority pulled mid-session, with the very next governed tool call failing closed rather than the session riding out to expiry.
- Someone will eventually ask you to prove the access log wasn't edited. Our chain answers with math: tampering, insertion, deletion, and truncation are told apart by name. Run the verifier.
- The re-identification store has to live in your own VPC, on your keys, with a documented way to crypto-shred a data subject out of it.
Pick Strac when
- You need redaction inside the live tool call, right now. Their gateway does that between agents and M365, Slack, GitHub, Snowflake, Salesforce and more. We don't sit inline and won't claim we do.
- Your exposure is Claude surfaces specifically: their Claude DLP product covers Chat, Desktop, Code, Cowork, and MCP connectors with real-time detection, redaction, and blocking.
- You need whole-perimeter DLP: endpoint, browser, email, and 40-plus SaaS integrations. We have no endpoint or browser story at all.
- Procurement needs SOC 2, ISO 27001, HIPAA, PCI and named logos on day one. Strac has them. We don't, and we say so on every page.
Bottom line: Strac decides what data passes through a tool call. DataShield decides whether the agent was allowed to make the call, and keeps proof of the decision. If your board question is "did anything sensitive leak into a prompt," buy Strac. If it's "prove what the agent was permitted to do, and prove the log is intact," that's us.
Feature by feature
Competitor cells describe what Strac's public site and blog say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Strac | Edge |
|---|---|---|---|
| MCP protection model | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Nothing sensitive sits in the queryable store to race at request time. | Gateway intercepts every tool call between the agent and the MCP server and redacts inline. Per-class remediation: redact in place, mask, tombstone, quarantine, or vault. | ◇ |
| Inline interception | None. We are not in the live request path, by design, and we won't pretend to be. | Yes, shipped, across M365, Google Workspace, Slack, GitHub, Snowflake, Salesforce, Atlassian, Stripe and more. | ◇ |
| Agent authorization | Every governed tool call passes a token scope ceiling, a declared authority tier, and a revocation re-check before dispatch. Cedar handles admin, config, and token decisions. | Admins can decommission MCP connections. We found no published per-call authority check or authority tiers. | ◆ |
| Agent identity | Auth issues the credentials: MCP tool tokens, RFC 9068 JWTs, JWKS rotation, an MCP services registry. We're the issuer, not a watcher. | OAuth-grant visibility for AI vendors plus agentless discovery of shadow MCP servers in repos and dev environments. Useful, but observational. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and lands in the chain, where it can't be quietly removed. | Not offered in their public docs. | ◆ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | An audit ledger per invocation, described as mapping to SOC 2, HIPAA, PCI and ISO 42001. No cryptographic immutability or public verification mechanism published. | ◆ |
| Tokenization | Deterministic HMAC tokens applied at ingest: join-preserving across datasets and vault-reversible, plus k-anonymity generalization of quasi-identifiers. Not format-preserving, and we don't claim it. | Tokenization is one remediation option per payload alongside mask, tombstone and quarantine, with token APIs and detokenize-on-approval. | ◆ |
| Re-identification store | Connection Vault and detokenization run self-hosted or in your VPC. Your keys, your account. | Vault with RBAC re-identification, hosted in their cloud. Every intercepted original lands there. Worth asking who holds the keys and where. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after a subject is erased. | GDPR and CCPA alignment stated. We found no published data-subject erasure workflow, and none for the re-identification vault. | ◆ |
| Deployment | Self-hosted, in your VPC, or BYOC. Signed licenses and design-partner source escrow. | Cloud-native SaaS, agentless, a 15-minute integration claim and a free trial. | ◆ |
| Maturity signals | Auth v1.0 live. Guardian and Lighthouse v0.2, in production since April 2026. No certifications, no named customers, and we won't imply otherwise. | YC W22, roughly $4M seed, SOC 2, ISO 27001, HIPAA, PCI, and customers including UiPath, CDC, Inmar and thredUP. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Sales-gated. No published figures found. | ◆ |
◆ DataShield leads◇ Strac leads◈ comparable
Strac claims are drawn from strac.io and its blog, last checked 13 September 2026. We link the sources below rather than paraphrase from memory.
Three things you get here that you won't get from a DLP gateway
We issue the agent's credentials
Strac can tell you which AI vendors hold OAuth grants. That's visibility into decisions someone else made. Auth mints the MCP tool token itself, caps what it can ever reach with a scope ceiling, and pins a declared authority tier to it. Discovery finds a shadow MCP server; issuance decides whether it gets to authenticate at all. How Auth does it.
Revocation that catches a running job
An analyst leaves on a Friday. Their agent is thirty minutes into a job. With DataShield the next governed tool call is re-checked against current authority and fails closed. Decommissioning a connection in an admin console doesn't reach inside a session already running. See the architecture.
Proof the ledger wasn't edited
"Audit-ready" means a log exists. Ours is a hash chain with Ed25519-signed checkpoints that are themselves chained, so deleting a checkpoint is detectable too, and the verifier tells you what went wrong. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers are designed to test for. Break one in your browser.
Where Strac is genuinely stronger
Their gateway is real and it's shipped. It sits between the agent and the MCP server and redacts inside the call, with remediation you can set per data class. Their detection reaches into PDFs, Word files and images, across endpoint, browser, email and forty-odd SaaS apps, and their Claude DLP product covers Claude Chat, Desktop, Code, Cowork and the MCP connectors by name. Add SOC 2, ISO 27001, HIPAA, PCI and customers like UiPath and thredUP, and for a lot of security teams that's a shorter procurement path than anything we can offer this year. If you need free-form payloads scrubbed in flight, we can't do it and I'm not going to invent a story where we can.
The push-back is about what a filter is for. A filter decides what data passes; it doesn't decide what the agent was allowed to do. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks, and a policy violation by a correctly-behaving agent with too much scope produces no detection event at all. And there's the thing that follows from the design: to redact PHI, the gateway had to read it, so a vault of originals lives in their cloud and grows every day. Ask where that store is, who holds the keys, and how a data subject gets removed from it with evidence.
Questions worth asking both of us
These are the five I'd put to a vendor sitting where we sit. Put them to us as well.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, and the check is yours to run rather than ours to assert. Every record commits to its predecessor, checkpoints carry an Ed25519 signature and chain to each other so lifting one out shows up too, and the verifier tells deletion apart from truncation and from tampering. There's a sample chain at /verify. Strac: their MCP audit ledger is described as mapping to SOC 2, HIPAA, PCI and ISO 42001. We found no published immutability or verification mechanism. Ask them to demonstrate one.
What happens to a revoked agent mid-session?
Authority is re-read at dispatch on every governed tool call, so a revocation bites on the next call and the context downgrades with it. Strac lets an admin decommission an MCP connection; we found no published per-call revocation re-check, which suggests a session already in flight keeps going. Get a number out of them: after the revocation, how many more calls can that session make?
How does GDPR erasure interact with the audit trail, and with the re-identification vault?
We destroy the subject's key material, which makes their data unreadable, and hand back an ISO 27560 receipt. Actor identities in the chain are HMAC commitments rather than names, so nothing has to be deleted for the erasure to be real. Strac states GDPR and CCPA alignment but we found no published erasure workflow, and their vault accumulates originals of everything intercepted. This is the question I'd press hardest on: erasure has to reach the vault too.
Strac intercepts tool calls inline and you don't. Isn't that a gap?
It's a real difference and we won't dress it up. Our answer is to move the problem earlier: datasets are tokenized at ingest, agents query tokenized data over MCP, and detokenization is a privileged, audited operation. There's no raw value in the queryable surface to race at request time. The trade-off is honest: if an agent pulls a free-form payload from a system we never ingested, a gateway catches it and we don't. Several buyers run both for that reason.
Where does the re-identification data actually live?
DataShield: your infrastructure. Self-hosted, in your VPC, or BYOC, with your keys and a documented crypto-shred path. Strac is cloud-native SaaS, so intercepted payloads and the vault of originals transit and rest in their cloud. If your rule is that PHI never leaves your account, that's the difference that decides it, regardless of who has the better detector.
Does DataShield have SOC 2?
No. Strac does, along with ISO 27001, HIPAA and PCI, and that row goes to them. What we offer instead is mechanisms you can check rather than attestations you have to accept: Auth is v1.0 with a published threat model and a verifier anyone can run, Guardian and Lighthouse are v0.2 and have been in production since April 2026, and design-partner terms include source escrow. Security page.
- Strac's current hero: "AI-Native Data Security Platform For SaaS." Primary CTA is "Book a Demo." — strac.io, 13 Sep 2026
- Strac's MCP gateway "intercepts every tool call"; its audit ledger is described as mapping to SOC 2, HIPAA, PCI and ISO 42001. — strac.io/blog/mcp-gateway, 13 Sep 2026
- Per-class remediation includes redact in place, mask, tombstone, quarantine, or vault with RBAC re-identification. — strac.io/blog/ai-dlp, 13 Sep 2026
- Strac's Claude DLP covers Claude Chat, Desktop, Code, Cowork and MCP connectors with real-time detection, redaction and blocking. — strac.io/blog, 17 Apr 2026
- Strac: YC W22, roughly $4M seed raised in July 2022 from Y Combinator and FUSE. — Y Combinator company profile, 13 Sep 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
Other head-to-heads
DataShield vs Skyflow
A privacy vault with an inline gateway, versus proof of what the agent did.
DirectDataShield vs Protecto
Detection rates are table stakes. What happens after detection is the fight.
DirectDataShield vs Noma Security
Full-lifecycle platform versus a verifiable evidence layer.
AllEvery comparison
Eleven vendors, one honest scorecard each.
See the mechanisms a filter can't run: break a live audit chain, revoke an agent mid-session, then decide whether you need one product or two. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →