Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Unstructured: who guards the PII your parser just extracted?

Unstructured does one hard thing very well. Point it at a scanned fax, a 400-page loan file, or a PPTX somebody built in 2011, and it hands back clean typed text, tables and chunks. Their homepage says it plainly: "We structure your unstructured data." 65+ file types, 40+ connectors, and a public price of $0.015 a page after the first 10,000 free ones. We are not going to argue with any of that, and we could not build it.

We are the layer after. DataShield is a governed data plane: the text your parser produced gets classified against 129 PII, PHI, financial and secret classes, datasets are tokenized at ingest, agents query tokenized data over MCP, and detokenization is a privileged, audited operation. Every governed tool call is re-checked against the agent's current authority, and the decision is sealed into a hash chain you can verify yourself. Below is the honest split, including the rows Unstructured wins outright.

Get free Demo Center access Get an instant quote
DataShield vs Unstructured at a glanceEight questions regulated buyers ask us. Scored from each vendor's public material. DataShield vs Unstructured at a glance Eight questions regulated buyers ask us. Scored from each vendor's public material. DataShield Unstructured Document parsing across 65+ file types Prebuilt source and destination connectors PII and PHI classification of extracted text Tokenization before the model sees it Authority re-checked on every tool call Tamper-evident audit chain you can verify FedRAMP High and SOC 2 Type II Published self-serve pricing shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The text coming out of the parser is full of PHI and somebody has to decide what an agent may read. We classify against 129 field classes, tokenize at ingest, and gate every value that leaves a governed dataset for a prompt. How the data plane works.
  • An examiner will ask you to prove the agent access log was not edited. Our chain answers with math. Run the verifier.
  • You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
  • Everything has to run on your own infrastructure, including the embedding model. We embed locally, so no text leaves for a third-party embedding API.

Pick Unstructured when

  • Your problem is the documents themselves. Scans, tables, mixed layouts, 65+ file types. That is their whole company and they publish benchmarks defending it.
  • You want connectors, not code. Over 40 sources and destinations, plus webhooks to wire the output into whatever comes next.
  • You are buying for a government or defence programme. FedRAMP High, CMMC 2.0 and a NAVSEA award with Elastic in February 2026. We have no FedRAMP path today.
  • You want to start this afternoon with a credit card and 10,000 free pages.

Bottom line: Unstructured turns your documents into text. It does not tell you which of that text is a patient identifier, and it does not decide who may read it. Most teams we talk to should run both, with Unstructured in front of us.

Feature by feature

Competitor cells describe what Unstructured's public site, docs and blog say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What mattersDataShieldUnstructuredEdge
Document parsingWe extract text from PDF, DOCX and EML and store it as a versioned derived file. Three formats, no OCR, no table model, no layout model. It is enough to get a contract or a discharge summary into a corpus. It is not a parsing product.The core product, and a good one. 65+ file types, OCR, table extraction, layout intelligence, published accuracy benchmarks they defend against frontier models.◇
ConnectorsIngest from uploaded files, SSRF-guarded URLs, and S3-compatible storage streaming multi-gigabyte objects. Plus a live PostgreSQL catalog connection. That is the list.Over 40 prebuilt source and destination connectors, plus webhooks to push pipeline output downstream.◇
PII and PHI in the extracted text129 built-in field classes covering PII, PHI, financial data and secrets, including all 18 HIPAA Safe Harbor identifiers and eight non-US national ID formats. Regex plus checksum validation (Luhn, NPI, Verhoeff, ABA, IBAN, GTIN), column-name lexicons and anti-pattern suppressors. Deterministic, so a verdict is reproducible from a config digest. No model, no drift.We found no PII detection, classification, redaction or tokenization feature on the homepage, pricing page, enterprise page, Extract post, Transform MCP post or the open-source README. Their compliance badges describe their own platform posture, not a feature applied to your documents.◆
Tokenization and data handlingDeterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. Every lookup in the token vault is admin-tier, tenant-scoped and audited, and the audit write must succeed or the lookup is refused.Not their job and they do not claim it. Text goes in, structured text comes out, with the sensitive values intact.◆
Prompt pathWe do not proxy your LLM traffic. We do gate every value that leaves a governed dataset for a prompt: a classified column with no configured treatment is redacted rather than passed through, and a PHI dataset refuses any AI endpoint not marked BAA or ZDR approved. Honest caveat: RAG document free text is served raw apart from one standing sensitive-pattern filter, so do not load documents whose body text must be masked.No prompt gate. The pipeline output is handed to whatever you point it at.◆
Embeddingspgvector with local nomic-embed-text embeddings, 768 dimensions, plus hybrid keyword and vector retrieval. Nothing leaves your box to be embedded.Embedding is a pipeline step with partner integrations. Where the text is embedded depends on the model you pick, and it is worth asking.◆
MCP and agentsMore than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with a scope ceiling and meters every call with agent attribution.Transform MCP, shipped July 2026: "a Model Context Protocol server that gives AI agents document processing as a callable tool." Real and shipping. We found no per-call authorization, scope ceiling or audit artifact described for it.◆
Agent authorizationEvery governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a mid-session revocation re-check before dispatch. It fails closed. Delegation is RFC 8693 token exchange with an enforced scope ceiling.Organisation accounts, role-based access control and fine-grained permissions on the platform itself. That governs who uses the console, not what an agent may do with the extracted text.◆
Break-glassScoped, time-boxed emergency access for agents, admin and IP-allowlist gated, step-up required, and it cannot be quietly deleted from the log.Not described in their public material.◆
Audit evidenceSHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification returns a three-valued verdict and names the failure: tampering, insertion, deletion or truncation. Try the verifier.The lakehouse post promises "one auditable path from raw document to production agent" when you write into Unity Catalog. The audit belongs to Databricks in that story, not to Unstructured.◆
GDPR erasureCrypto-shred of per-subject key material, plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the audit still verifies after the subject is gone.GDPR compliance is claimed as a platform posture. We found no described erasure mechanism for content already pushed downstream.◆
DeploymentSelf-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest verified by Guardian. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment or derive from your machine key today, not in a KMS.Managed SaaS, dedicated instance, VPC or bare metal on the Business tier. The open-source library runs anywhere you can run Python, under Apache 2.0.◈
Compliance and public sectorSOC 2 not yet certified, and we say so. No FedRAMP path. Our standards work is design citations, mapped to the mechanism: HIPAA §164.312(b), §164.514(b)(1) and (b)(2), GDPR Art. 17, ISO 27560, RFC 8785.FedRAMP High certified, SOC 2 Type II qualified, HIPAA and GDPR claimed, CMMC 2.0. NAVSEA contract with Elastic, February 2026.◇
Maturity signalsAuth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). Field classification cut over from shadow mode to live very recently, so call it new rather than battle-tested. Small team, source escrow on design-partner terms.Founded 2022, 15.4k stars on the open-source library, Fortune 500 logos including IBM, JPMorgan Chase, Bank of America and Humana.◇
PricingPublished model, scoped instant quote, no sales wall.Published too: 10,000 free pages, then $0.015 a page. The Business tier with VPC or bare metal is quote-only.◈

◆ DataShield leads◇ Unstructured leads◈ comparable

Unstructured claims are drawn from unstructured.io, their pricing and enterprise pages, their blog and their GitHub repository, last checked 13 September 2026. We link them below rather than work from memory.

Three things you get here that you won't get from a document ETL tool

The parser's output, classified

A discharge summary parsed into perfect JSON is still a discharge summary. We label every field against 129 classes, including all 18 HIPAA Safe Harbor identifiers, using regex, checksums and column-name evidence rather than a model. The verdict is reproducible from a config digest, which matters the day someone asks why a column was labelled the way it was. See the classifier.

Authority that can change mid-flight

An analyst resigns on a Friday. Their agent is 20 minutes into a 40-minute job over your contract corpus. With DataShield the next governed tool call is re-checked against current authority and fails closed. A pipeline tool has no opinion about this, because it was never asked. How Auth does it.

Proof that survives an audit

A log that can be silently edited proves nothing. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Where Unstructured is genuinely stronger

Parsing is harder than people think, and they have the receipts. Their November 2025 benchmark post and their April 2026 piece arguing that frontier models still lose to a purpose-built parser are the work of a team that has stared at broken PDFs for four years. 65+ file types, OCR, table extraction, layout handling: none of that is ours, and we do not pretend. Our extraction covers PDF, DOCX and EML, which is enough to fill a corpus and nothing like a parsing product. Add 40-plus connectors, webhooks, an Apache 2.0 library with 15.4k stars, FedRAMP High, and a NAVSEA award, and you have a company with a real moat in a real category. Their pricing is public and cheap to try, which we respect, because we publish ours too.

Here is the push-back, and it is a narrow one. Read their June 2026 lakehouse post carefully: the promise is that your documents "inherit the governance your team already built" once they land in Unity Catalog. That is an honest answer, and it is also an admission. The governance is somewhere else. Now look at Transform MCP from July 2026, where an agent calls the parser directly and the extracted text goes straight back into the model's context. In that path there is no lakehouse, no inherited governance, and nothing that noticed the medical record numbers on page four. That is the seam we sell into. Run their parser, land the output in a governed dataset, and let the agent query it under a tool token instead of a cURL.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Unstructured: their material points at the destination platform for audit, such as Unity Catalog. Ask who holds the log when an agent calls Transform MCP directly and no lakehouse is involved.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call and the call fails closed. Unstructured's enterprise page describes role-based access control and fine-grained permissions for the platform. We could not find any per-call authorization or revocation behaviour for their MCP server in public docs. Ask how long a revoked agent keeps parsing.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Unstructured claims GDPR compliance as a platform posture. What happens to a subject's data in the parsed output you already shipped to three destinations is your problem, not theirs. Ask them where erasure lands.

Where does PII get redacted or tokenized in an ETL for LLMs pipeline?

This is the question. In our path, classification runs on the dataset, tokens are applied at ingest, and the prompt-egress gate redacts any classified column with no configured treatment rather than letting it through. A PHI dataset refuses an AI endpoint that is not marked BAA or ZDR approved. In Unstructured's published material we found no PII detection, redaction or tokenization feature at all, on any page we checked on 13 September 2026. Ask them to show the feature, not the certification.

Is DataShield an Unstructured alternative, or do we run both?

Mostly both. If your pain is scanned PDFs and mixed layouts, buy their parser, because ours handles PDF, DOCX and EML and stops there. Run us where the output lands: classified, tokenized, queried by agents under tool tokens, with a chain you can verify. The one case where we do replace them is a team already inside PostgreSQL whose documents are ordinary text files, and who wanted the governance more than the OCR.

Does DataShield have SOC 2 or FedRAMP?

Neither, and we will not imply otherwise. Unstructured has FedRAMP High and SOC 2 Type II qualification, and on that row they beat us cleanly. What we offer instead is a published threat model, a verifier anyone can run, and source escrow on design-partner terms so a small vendor is not a single point of failure. Details on the security page.

Other head-to-heads

RAG

DataShield vs LlamaIndex

A framework for building RAG, and the governance it leaves to you.

 RAG

DataShield vs Ragie

Managed RAG as a service, versus RAG you can self-host and prove.

 RAG

DataShield vs Contextual AI

Grounded answers for the enterprise, and who authorized the read.

 All

Every comparison

One honest scorecard per vendor.

See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your parsing pipeline still owes your compliance team. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →