Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Weaviate: your vector database is fine, but can you prove what the agent read?

Weaviate is a good vector database. Not "good for an open-source project", just good. The hero on their homepage reads "Design, build and ship complete AI experiences", with the sub-line "Vector search, RAG, and memory - all in one open-source platform." They have earned the right to say it: 20M+ downloads, hybrid search, multi-tenancy that one customer runs with 50,000 tenants in a single cluster, and a steady run of index work through 2026. We are not going to out-engineer their index and we are not going to pretend we tried.

Here is the part their docs do not cover. Weaviate stores and serves whatever you embed. It has no view on whether that chunk held a member ID. DataShield classifies fields against 129 PII, PHI, financial and secret classes first. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings run locally, so the text never leaves your infrastructure. Every governed tool call is re-checked against the agent's authority before it runs, and the decision is sealed into a hash chain you can verify yourself. Most teams should run both. This page says which job lands where.

Get free Demo Center access Get an instant quote
DataShield vs Weaviate at a glanceEight questions regulated RAG buyers ask us. Scored from each vendor's public material. DataShield vs Weaviate at a glance Eight questions regulated RAG buyers ask us. Scored from each vendor's public material. DataShield Weaviate Tamper-evident audit chain you can verify Authority re-checked on every tool call PII and PHI classified before anything is embedded GDPR erasure that keeps the chain valid Vector index engineering and retrieval scale SOC 2 and HIPAA today Run the whole thing on your own hardware Price published before you talk to sales shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The corpus holds health, financial or personal data, and someone has to say in writing what was embedded. We classify the fields first, then build chunks and vectors from the masked view. How the catalog works.
  • An examiner will ask you to prove the retrieval log was not edited later. Our chain answers with maths, not a policy PDF. Run the verifier.
  • You need to pull an agent's authority mid-session and have the very next tool call fail. Not the next token refresh.
  • Embeddings must be computed in your own environment. Ours run on a local model, so no chunk text is sent to a third party.

Pick Weaviate when

  • Retrieval quality and scale are the whole job. Nine billion vectors in one production deployment is their customer's number, not ours, and we have nothing like it.
  • You want a real open-source core under a BSD-3 licence, with a large community and 20M+ downloads behind it. That is a genuine hedge against vendor risk.
  • You need SOC 2 and HIPAA today from the vendor running your cluster. They have both. We do not.
  • The agent memory layer matters. Engram went GA in June 2026 and is a product line we do not have at all.

Bottom line: Weaviate is where your vectors should live if scale is the problem. DataShield is where the sensitive corpus should live if proof is the problem. If you only have budget for one and the data is regulated, start with the layer that answers the auditor.

Feature by feature

Competitor cells describe what Weaviate's public docs, blog and pricing page say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.

What mattersDataShieldWeaviateEdge
Vector search and indexingpgvector with 768-dimension vectors per corpus, plus a keyword leg over tsvector for hybrid retrieval. It works. It is not a specialist engine and we have published no retrieval benchmark, so do not take a number from us.The core product, and years of work in it. HFresh disk-based index GA in June 2026, BlockMax WAND, rotational quantization down to 4 bits in preview, MMR diversity selection, replica movement. This is their craft.◇
What gets embeddedFields are classified against 129 classes before ingest, covering all 18 HIPAA Safe Harbor identifiers, eight national ID formats and 11 secret types. Where a dataset has masked columns, chunk text and vectors are built from the masked view, so the raw value is never embedded. Free-text documents are indexed as written apart from one standing pattern filter, and our own tool docs say so.It stores what you send it. We found no classifier, no sensitive-field detection and no masking layer in their docs. That is a fair design choice for a database. It does mean the scrubbing is your code.◆
Embedding model and egressLocal nomic-embed-text, 768 dimensions, running in your environment. No chunk text is sent to an embedding vendor.Self-hosted Weaviate can point at a local model. Weaviate Cloud also sells an embedding service, and most of the documented paths call a third-party model provider. Both are available, so check which one your team actually wired up.◈
Audit evidenceSHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification returns one of three verdicts and names the failure: tampering, insertion, deletion or truncation. See the verifier.Six Prometheus metrics under weaviate_mcp_* for tool traffic, latency, auth failures and the write-access flag. Useful for operations. We found no per-retrieval audit record and no tamper evidence over one.◆
Agent authorizationEvery governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a mid-session revocation re-check before dispatch. It fails closed. Cedar covers admin, config and token decisions, not the dispatch path, and we will not claim otherwise.Real RBAC on the MCP server: read_mcp, create_mcp and update_mcp permissions, a predefined viewer role, plus MCP_SERVER_ENABLED and MCP_SERVER_WRITE_ACCESS_ENABLED deployment flags. Better than a global toggle. It is still a static grant checked at execution, not authority that can change while a job runs.◆
Break-glassScoped, time-boxed emergency access for agents, admin and step-up gated, IP-allowlisted, and fully logged. It expires on its own.Not described in their public docs.◆
GDPR erasureCrypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the evidence still verifies after the subject is gone.Object deletion and TTL support. An embedding derived from deleted text is a harder question and their docs do not take it on. Ask them what happens to the vector.◆
TokenizationDeterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column.Not part of the product, and they do not claim it.◆
MCP and agentsMore than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings and meters every call with the agent attributed. Ontology's MCP surface authenticates by API key with per-tool tier gating.Built-in MCP server GA in v1.38, June 2026, served on the REST port. Four tools: hybrid query, collection config, tenant list and object upsert. Plus the agents line, Query Agent GA since September 2025 and Engram GA since June 2026.◈
Agent memory and orchestrationNone. We govern datasets and retrieval. Memory for your agents is your framework's problem.Engram, a managed memory and context service, GA on 3 June 2026, plus Transformation and Personalization agents. A real product line.◇
DeploymentSelf-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest Guardian checks. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS.Open source under BSD-3 and genuinely self-hostable on Docker or Kubernetes, which is the strongest self-host story among the pure-play vector vendors. Also managed cloud in about 40 regions on AWS, GCP and Azure, dedicated tenants, and bring your own cloud.◈
Maturity signalsAuth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). RAG is GA. SOC 2 not yet certified, and we say so.Founded 2019, Amsterdam, $50M Series C in October 2025, SOC 2 and HIPAA claimed on their security page, and an enterprise logo wall including Cisco, Intuit, Thales and Booking.◇
PricingPublished model and a scoped instant quote. No sales wall.Published and clear: free tier at 100k objects, Flex from $45 a month pay as you go, Premium from $400 a month prepaid. Credit to them, most of this market hides it.◈

◆ DataShield leads◇ Weaviate leads◈ comparable

Weaviate claims are drawn from weaviate.io, docs.weaviate.io and their own blog, last checked 13 September 2026. Links are at the bottom of this page.

Three things you get here that you won't get from a vector database

The corpus is classified before it is indexed

A vector index is happy to embed a member ID. It has no opinion. We label columns against 129 classes first, then build chunks and vectors from the masked view. The method is regex, checksums such as Luhn and IBAN, column-name lexicons and anti-pattern suppressors. No model, so the same input gives the same verdict next year. See the catalog.

Authority that can change mid-flight

An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute retrieval job. With DataShield the next governed tool call is re-checked against current authority and fails closed. An RBAC grant made at token time does not do that. How Auth does it.

Proof that survives an audit

"Trust me, this is the retrieval log" is not evidence. Ours is a hash chain with signed checkpoints, and the verifier says what broke, not just that something did. That is the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Where Weaviate is genuinely stronger

Almost everything about retrieval itself. They have been building this since 2019 and it shows in the boring places: disk-based indexes for memory-tight clusters, quantization that keeps recall while shrinking vectors, replica movement, multi-tenancy at counts most teams will never reach. Their 2025 framing was "dependability before abstraction", which is an unfashionable thing to write and the right instinct. The open-source core is real, not a teaser edition, so you can walk away from the vendor and keep running. They also ship faster than we do, and they got to SOC 2 and HIPAA before us. On the agent side, Query Agent has been GA since September 2025 and Engram since June 2026, and we have no answer to either.

The push-back is narrow and it is about the job next door. Their MCP server exposes four tools and gates them with RBAC permissions, which is a sensible design. But a permission is a grant, not a record. Nothing in their docs tells you which agent retrieved which chunk at 02:14 on a Tuesday, whether that agent still had the right to, or whether the log saying so has been edited since. For an internal analytics app that is fine. For a clinical or lending corpus it is the whole conversation, because Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks. Those do not trip a security alert. They only show up in evidence, and only if the evidence is worth reading.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove a retrieval log entry wasn't deleted?

DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Weaviate: their MCP server emits six Prometheus metrics. Those are counters, not a record of what was read, and a metrics store is not tamper evident. Ask them to show you a per-retrieval log and how you would detect an edit to it.

What happens to a revoked agent mid-session?

DataShield re-checks authority on every governed tool call, so revocation lands on the next call. Weaviate enforces RBAC permissions at tool execution, which is real enforcement, but the grant is the thing that was checked. We could not find mid-session revocation in their docs. Ask how long a compromised agent keeps querying after you pull its role.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. Weaviate supports object deletion and TTL. The awkward part is the embedding: a vector derived from a person's text is derived data, and deleting the object does not obviously settle it. Their docs do not address it. Ask.

Is DataShield a Weaviate alternative, or do we run both?

Mostly both, and we would rather say that than sell you a worse index. Our RAG is GA and honest: pgvector, hybrid keyword and vector retrieval, local embeddings, ingest from files, URLs and S3-compatible storage with PDF, DOCX and EML extraction. It is enough for a governed corpus of policies, claims or clinical notes. It is not enough for nine billion vectors. Run Weaviate for scale, run us for the corpora where someone has to sign a form.

We're building a HIPAA RAG app. Why not just use Weaviate Cloud, which is HIPAA compliant?

You can, and for many teams that is the right call. But HIPAA compliance of the host tells you the cluster is handled properly. It does not tell you the PHI needed to be in the chunk at all. Our egress gate is the other half: a PII or PHI column with no configured treatment is redacted rather than passed through, and a PHI-classified dataset refuses an AI endpoint that is not marked BAA or ZDR approved. It fails closed and it says why. Minimum necessary is a §164.502(b) obligation on you, not on your database vendor.

Does DataShield have SOC 2?

Not yet, and we will not imply otherwise. Weaviate does, along with HIPAA, and that is a straight win for them on any procurement checklist. What we offer instead is a published threat model, a verifier anyone can run without an account, and design-partner terms that include source escrow so a small vendor is not a single point of failure. Details on the security page.

Other head-to-heads

Vector DB

DataShield vs Pinecone

Managed vector search at scale, versus governed retrieval you can prove.

 Vector DB

DataShield vs Qdrant

Rust-fast open-source search, and the evidence layer above it.

 Vector DB

DataShield vs Milvus and Zilliz

Billion-scale indexes, versus classification before embedding.

 All

Every comparison

One honest scorecard per vendor.

See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then ask what your vector database still owes your compliance team. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →