Head-to-head · updated 13 September 2026
DataShield vs Chroma: what happens to the PHI before it gets embedded?
Chroma calls itself "open-source search infrastructure for AI", and that is a fair description. One engine gives you dense vectors, BM25 and SPLADE sparse vectors, regex and metadata filters. It is Apache 2.0, it runs on your laptop in a line of Python, and it has 15 million downloads a month to show for it. Their Context Rot report is also the best piece of writing anyone in this market published in 2025. We read it twice.
We are not a better vector store and we are not going to pretend otherwise. DataShield is what sits around the corpus. Fields get classified against 129 PII, PHI, financial and secret classes. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings are computed locally, so no chunk of your corpus is posted to a third-party embedding API. Every governed tool call is checked against the agent's authority at the moment of the call, and the decision is sealed into a hash chain you can verify yourself. Below is the split, including the rows Chroma wins outright.
The short version
Pick DataShield when
- The corpus holds PHI, claims data or support tickets with card numbers in them, and someone has to answer for what the model saw. We classify, mask and tokenize before the text is indexed. How the data plane works.
- You will be asked to prove an agent's retrieval log was not edited later. Our chain answers with a hash and a signature, not a policy PDF. Run the verifier.
- You need to pull an agent's authority mid-session and have the very next governed tool call fail closed. Not the next token refresh. The next call.
- The embeddings, the keys and the evidence all have to stay on your own infrastructure, and you would rather not send chunks to a hosted embedding API at all.
Pick Chroma when
- Retrieval quality is the project. Vector, full-text, regex and metadata search in one engine is a real advantage, and they publish research on why it matters.
- You want to start in ten minutes and pay almost nothing. Apache 2.0 locally, $0 plus usage on Cloud, and published per-GiB rates.
- Your corpus is public or low-sensitivity: docs, code, marketing copy, crawled web pages. Governance you do not need is just overhead.
- You want a big open-source community around the thing you depend on. 27,000 stars and 90,000 dependent repos is a real safety net, and we do not have one.
Bottom line: Chroma is where the chunks go. DataShield decides which chunks an agent may see, what has been masked out of them first, and keeps proof of the answer. If your corpus is documentation, buy Chroma and stop reading. If it is clinical notes, the retrieval engine is the easy part.
Feature by feature
Competitor cells describe what Chroma's public site, docs and engineering posts say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Chroma | Edge |
|---|---|---|---|
| Retrieval engine | pgvector in Postgres, hybrid retrieval with a tsvector keyword leg and a vector leg. Good enough for governed corpora. It is not a distributed search engine and we do not tune it like one. | The whole product, and the best part of it. Dense vectors, BM25 and SPLADE sparse vectors, regex and metadata filters in one object-storage-backed engine, with published recall and latency figures. | ◇ |
| Embeddings | Local nomic-embed-text, 768 dimensions, running in your deployment. No chunk of your corpus is posted to a third-party embedding API. | Bring your own embedding function, including local ones. Their own Context-1 search model runs on their side. The common path in their docs is a hosted provider. | ◈ |
| PII and PHI handling before indexing | Fields are classified against 129 classes, including all 18 HIPAA Safe Harbor identifiers, using regex, checksum validators, column-name lexicons and anti-pattern suppressors. Chunks and embeddings for column-masked datasets derive from the masked view, and chunk views apply read-time masking with the keyword index rebuilt from masked text, so search cannot be used to probe for a redacted value. Honest limit: free-text documents are indexed raw apart from one standing sensitive-pattern filter. | None. It is a search engine and does not claim otherwise. What you put in the collection is what gets embedded. | ◆ |
| Tokenization | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Tokens are deterministic and join-preserving, so an analyst can still join across datasets without seeing a value. Plus quasi-identifier generalization: dates to year, decade or age band, ZIPs to 3 or 4 digits, partial phones, SSNs and emails, with a measured cardinality-reduction score per column. | Not vocabulary they use. Customer-managed encryption keys protect data at rest in Cloud, which is a different control. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a consented-tool allowlist, an authority tier and a mid-session revocation re-check before dispatch. The call fails closed. | Their MCP server exposes twelve tools that create, query, add, update and delete collections and documents. The docs describe optional auth credentials on self-hosted HTTP, and no per-agent authorization, RBAC or audit logging. Any connected client is a full client. | ◆ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification returns clean, attested damage or tampered, and names truncation, insertion and deletion separately. Try the verifier. | Real-time indexing monitoring and OpenTelemetry. We found no tamper-evident log of who retrieved what. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents, admin and IP-allowlist gated, step-up authenticated, fully audited. It auto-revokes. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities in the chain are HMAC-committed, so the chain still verifies after the subject is gone. | You can delete documents from a collection. Whether the vectors derived from a deleted person are also gone is your problem to reason about, and their docs do not take it up. | ◆ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings, meters each call and attributes it to the agent. | An official MCP server, and an early one. Twelve tools over ephemeral, persistent, HTTP and cloud clients. Good developer ergonomics, no authorization model. | ◆ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images ship for Auth, Ontology, Corpus and Lighthouse, with a signed deploy manifest verified by Guardian. Ed25519 audit-signing keys can live in your KMS or HSM. HMAC tokenization keys sit in your environment or derive from your machine key today, not in a KMS. | Local, self-hosted OSS, managed Cloud, and since February 2026 a Bring Your Own Cloud tier: bucket, metadata database, Kubernetes and VPC inside your account, operated by them. Enterprise also lists single-tenant clusters. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). Field classification cut over from shadow mode this month, so it is new. SOC 2 not yet certified, and we say so. | Founded 2022, $18M Series B in October 2025 at around a $75M valuation, roughly 100 people, 15M downloads a month, SOC 2 Type II on Cloud. Small company, large footprint. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Also published, and more granular than ours: $0 plus usage on Starter, $250 a month plus usage on Team, with per-GiB write, storage, query and egress rates. Enterprise is sales-led. | ◈ |
◆ DataShield leads◇ Chroma leads◈ comparable
Chroma claims are drawn from trychroma.com, its docs, its pricing page and its engineering and research posts, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a vector database
The masking happens before the index does
A vector is not a safe place to put a social security number. Once text is embedded and indexed, the sensitive bit is in two places and one of them is hard to search for. We classify the fields first, apply the masking view, and build the chunks and the keyword index from the masked text. What the classifier covers.
Authority that can change mid-flight
An analyst leaves on a Friday. Their research agent is 20 minutes into a 40-minute retrieval job. With DataShield the next governed tool call is re-checked against current authority and fails closed. A vector store has no opinion on this, because it was never asked. How Auth does it.
Proof of what was retrieved
"Which documents did the agent read in March?" is a question you get asked once, and usually by someone with a subpoena. Ours is a hash chain with signed checkpoints, and the verifier tells you what broke rather than just that something did. Try it in your browser, no signup.
Where Chroma is genuinely stronger
Start with the obvious. Chroma is a better retrieval engine than ours and the gap is not close. One product covers dense vectors, sparse BM25 and SPLADE, regex and metadata filters, built on object storage with automatic tiering, with published recall and latency numbers. We run pgvector with a keyword leg beside it. That is fine for a governed corpus and it is not a distributed search engine. Their research is also doing real work for the field: Context Rot, in July 2025, showed that model accuracy degrades non-uniformly as input length grows, which is the honest argument for why retrieval still matters in a million-token world. Context-1, in March 2026, is a 20B agentic search model that decomposes queries and edits its own context. We do not have a research lab. And their community, 27,000 stars and 90,000 dependent repos, is a kind of insurance a small vendor cannot offer.
Here is the push-back. Look at who they list as customers: Capital One, UnitedHealthcare, Medwise. Those are corpora with rules attached. Chroma's own answer to enterprise risk has been encryption at rest with your keys, PrivateLink, and now BYOC, which are all controls on the pipe and the disk. None of them tells you that a chunk contained a member ID, which agent asked for it, or whether that agent was still allowed to ask. Their MCP server is a fair illustration: twelve tools, full read and write, and nothing in the docs about who may call them. That is a reasonable design for a developer tool and a poor one for a claims corpus. Encryption protects the data from someone who should not have it. It does nothing about the agent that should.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are Ed25519-signed and chained, and verification tells deletion apart from truncation and from tampering. Run it against a sample chain at /verify. Chroma: they ship indexing monitoring and OpenTelemetry, which is observability rather than evidence. We found no tamper-evident retrieval log. Ask them to show one.
What happens to a revoked agent mid-session?
DataShield re-checks session authority on every governed tool call, so revocation lands on the next call and the context is downgraded. Chroma's MCP server documents optional auth credentials for self-hosted HTTP clients and no per-call authorization. If you pull an agent's key, ask how long its open client keeps querying.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the subject's key material, which makes every ciphertext for that subject unreadable at once, and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies. Chroma lets you delete documents from a collection. Ask what happens to the embeddings derived from those documents, and to anything already cached, because a vector is still data about a person.
Do we have to drop Chroma to use DataShield?
No, though most people end up choosing one place for the chunks. Plenty of teams keep Chroma for the public corpus, the docs site, the code search, and run governed retrieval here for the regulated one. What does not work is putting PHI in an unclassified collection and hoping the access control arrives later.
Chroma has BYOC now. Doesn't that solve the residency problem?
It solves residency, and we should say so plainly: since February 2026 they will run a bucket, a metadata database, a Kubernetes cluster and a VPC inside your own account, with the data plane staying in your environment. That is a real answer to "the data cannot leave." It is not an answer to "prove this agent was allowed to read that document." Residency is about where the bytes sit. Authorization and evidence are about who touched them.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Chroma has SOC 2 Type II on Cloud and we do not. What we publish instead is a threat model, a verifier anyone can run, and a security page that lists the gaps. Auth is live in production; Guardian and Lighthouse have been since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- Chroma's positioning, verbatim: "Open-source search infrastructure for AI" supporting vector, full-text, regex and metadata search, with 15M+ monthly downloads and 27k GitHub stars. — trychroma.com, 13 Sep 2026
- Distributed Chroma BYOC deploys a bucket, metadata database, Kubernetes cluster and VPC in the customer's own account, keeping the data plane "within your controlled environment." — Chroma engineering, 9 Feb 2026
- Context Rot: across 18 models, "model performance degrades as input length increases, often in surprising and non-uniform ways." — Chroma research, 14 Jul 2025
- Context-1 is a 20B agentic search model that decomposes queries, searches iteratively and edits its own context. — Chroma research, 26 Mar 2026
- Published Cloud pricing: Starter $0/month plus usage, Team $250/month plus usage, and meters of $2.50 per GiB written, $0.33 per GiB-month stored, $0.0075 per TiB queried, $0.09 per GiB egress. Enterprise adds single-tenant and BYOC clusters. — trychroma.com/pricing, 13 Sep 2026
- The official Chroma MCP server exposes twelve collection and document tools; its documentation describes no per-user authorization, RBAC or audit logging. — chroma-core/chroma-mcp on GitHub, 13 Sep 2026
Other head-to-heads
DataShield vs Pinecone
Managed vector search at scale, versus governance around the corpus.
Vector DBDataShield vs Qdrant
Rust-fast filtering, and the access control it leaves to you.
Vector DBDataShield vs Weaviate
Modules and hybrid search, versus tokenized data and per-call authority.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then decide what your vector store still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →