Get Demo Center access

Head-to-head · updated 13 September 2026

DataShield vs Chroma: what happens to the PHI before it gets embedded?

Chroma calls itself "open-source search infrastructure for AI", and that's a fair description. One engine gives you dense vectors. BM25 and SPLADE sparse vectors. Regex and metadata filters too. It's Apache 2.0. It runs on your laptop. In a line of Python. It has 15 million downloads a month. To show for it. Their Context Rot report is also the best piece of writing. Anyone in this market published it. That was 2025. We read it twice.

We're not a better vector store. We won't pretend otherwise. DataShield is what sits around the corpus. Fields get classified. Against 129 PII, PHI, financial and secret classes. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data. A privileged step. It's audited every time. Embeddings get computed locally, too. No chunk of your corpus gets posted. Not to a third-party embedding API. We check each checked tool call. Against the agent's access. Right at the moment of the call. The decision seals into a hash chain. You can verify it yourself. Here's the split, including the rows Chroma wins outright.

Get free Demo Center access Get an instant quote
DataShield vs Chroma at a glanceEight questions regulated buyers ask us about RAG. Scored from each vendor's public material. DataShield vs Chroma at a glance Eight questions regulated buyers ask us about RAG. Scored from each vendor's public material. DataShield Chroma Tamper-evident audit chain you can verify Authority re-checked on every governed tool call PII and PHI classified before text is indexed Break-glass access for agents Retrieval scale and query types Open-source adoption and developer experience Local embeddings, nothing sent to an embedding API Published pricing you can read without a call shipped partial / roadmap not offered Sources at the bottom of this page.

The short version

Pick DataShield when

  • The corpus holds PHI, claims data or support tickets with card numbers in them. Someone has to answer for what the model saw. We classify, mask and tokenize, before the text gets indexed. How the data plane works.
  • You will be asked to prove an agent's retrieval log wasn't edited later. Our chain answers with a hash and a signature, not a policy PDF. Run the verifier.
  • You need to pull an agent's access mid-session. The very next checked tool call should fail closed. Not the next token refresh. The next call.
  • The embeddings, the keys and the evidence all have to stay on your own infrastructure. You'd rather not send chunks to a hosted embedding API, at all.

Pick Chroma when

  • Retrieval quality is the project. Vector, full-text, regex and metadata search, in one engine. A real advantage. They publish research on why it matters, too.
  • You want to start in ten minutes, and pay almost nothing. Apache 2.0 locally. $0 plus usage on Cloud. Published per-GiB rates.
  • Your corpus is public or low-sensitivity. Think docs, code, marketing copy, crawled web pages. Governance you don't need is just overhead.
  • You want a big open-source community, around the thing you depend on. 27,000 stars and 90,000 dependent repos is a real safety net. We don't have one.

Bottom line: Chroma is where the chunks go. DataShield decides which chunks an agent may see. It decides what got masked out of them, first. It keeps proof of the answer, too. Is your corpus documentation? Buy Chroma and stop reading. Is it clinical notes? The retrieval engine is the easy part.

Feature by feature

Competitor cells describe what Chroma's site, docs and engineering posts say. We use the date above. Did we get a fact wrong? Email support@myorg.ai. We'll correct it, and credit you.

What mattersDataShieldChromaEdge
Retrieval enginepgvector in Postgres. Hybrid retrieval. With a tsvector keyword leg and a vector leg. Good enough for checked corpora. It's not a distributed search engine, though. We don't tune it like one.The whole product. And the best part of it. Dense vectors, BM25 and SPLADE sparse vectors. Regex and metadata filters, too. All in one object-storage-backed engine. Published recall and latency figures.◇
EmbeddingsLocal nomic-embed-text, at 768 dimensions. Running in your deployment. No chunk of your corpus goes to a third-party embedding API.Bring your own embedding function. Including local ones. Their own Context-1 search model runs on their side. The common path in their docs runs through a hosted provider.◈
PII and PHI handling before indexingFields get classified against 129 classes. That covers all 18 HIPAA Safe Harbor identifiers. We use regex and checksum validators. Plus column-name lexicons and anti-pattern suppressors. Chunks and embeddings, for column-masked data sets. They derive from the masked view. Chunk views apply read-time masking. The keyword index gets rebuilt from masked text. You can't probe search for a redacted value. Honest limit: free-text documents are indexed raw. Apart from one standing sensitive-pattern filter.None. It's a search engine. It doesn't claim otherwise. What you put in the collection is what gets embedded. Plain and simple.◆
TokenizationWe tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back is a privileged step. It's logged, always. Tokens are deterministic and join-preserving. An analyst can still join across data sets. Without seeing a value. Plus quasi-identifier generalization. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking too. Each column gets a measured score.Not vocabulary they use. Customer-managed encryption keys protect data at rest in Cloud, instead. That's a different control.◆
Agent authorizationEvery checked tool call passes a scope ceiling. It also passes a consented-tool allowlist. Plus an access tier, and a mid-session re-check. Before dispatch. The call fails closed.Their MCP server exposes twelve tools. They create, query, add, update and delete. Collections and documents. The docs describe optional auth credentials. On self-hosted HTTP. No per-agent authorization, RBAC or audit logging. Any connected client is a full client.◆
Audit evidenceSHA-256 row chain. With Ed25519-signed checkpoints that are themselves chained. Verification returns one of three verdicts. Clean, attested damage, or tampered. It names truncation, insertion and deletion. Separately. Try the verifier.Real-time indexing monitoring, plus OpenTelemetry. We found no tamper-evident log. None showing who retrieved what.◆
Break-glassScoped, time-boxed emergency access for agents. Admin and IP-allowlist gated. Step-up authenticated, fully audited. It auto-revokes on its own.Not described in their public docs.◆
GDPR erasureCrypto-shred of per-subject key material. Plus ISO 27560 consent receipts too. Actor identities in the chain carry HMAC commitments. Not names. The chain still checks out. After the subject is gone.You can delete files from a collection. Whether the vectors from a deleted person are also gone: that's your problem. Their docs don't take it up.◆
MCP and agentsMore than 200 MCP tools. Across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens, with scope ceilings. It meters each call. And attributes it to the agent.An official MCP server. An early one. Twelve tools. Over ephemeral, persistent, HTTP and cloud clients. Good developer ergonomics. No authorization model, though.◆
DeploymentSelf-hosted. In your own cloud or data center, your call. Or a dedicated single-tenant server we run for you. Docker images cover Auth, Ontology, Corpus and Lighthouse. A signed deploy manifest, verified by Guardian. Ed25519 audit-signing keys stay on your instance. In a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS custody is a built seam in Auth. So is HSM. Not a shipped integration. HMAC tokenization keys sit in your environment today. Or they derive from your machine key. Not from a KMS.Local, self-hosted OSS. Managed Cloud, too. Since February 2026, a Bring Your Own Cloud tier. Bucket, metadata database, Kubernetes and VPC. Inside your account, operated by them. Enterprise also lists single-tenant clusters.◈
Maturity signalsAuth, Guardian and Lighthouse are all live now. Guardian and Lighthouse have run since April 2026. Field classification cut over from shadow mode this month. So it's new. SOC 2 isn't certified yet, and we say so.Founded 2022. An $18M Series B in October 2025. At around a $75M valuation. Roughly 100 people. 15M downloads a month. SOC 2 Type II, on Cloud. Small company, large footprint.◇
PricingPublished model, a scoped instant quote, no sales wall.Also published. And more granular than ours. $0 plus usage on Starter. $250 monthly, plus usage, on Team. Per-GiB write, storage, query and egress rates. Enterprise is sales-led.◈

◆ DataShield leads◇ Chroma leads◈ comparable

We draw Chroma claims from a few places. trychroma.com, its docs, its pricing page. Plus its engineering and research posts. Last checked 13 September 2026. We link them below. Not just a paraphrase from memory.

Three things you get here that you won't get from a vector database

The masking happens before the index does

A vector is not a safe place. Not for a social security number. Once text is embedded and indexed: the sensitive bit sits in two places. One of them is hard to search for. We classify the fields first, then apply the masking view. We build the chunks and the keyword index. From the masked text. What the classifier covers.

Authority that can change mid-flight

An analyst leaves on a Friday. Their research agent is 20 minutes into a 40-minute retrieval job. Unaware. DataShield re-checks the next checked tool call. Against current access, right then. It fails closed. A vector store has no opinion on this. It was never asked. How Auth does it.

Proof of what was retrieved

"Which files did the agent read in March?" You get asked that once. Usually by someone with a subpoena. Ours is a hash chain with signed checkpoints. The verifier tells you what broke. Not just that it did. Try it in your browser, no signup.

Where Chroma is genuinely stronger

Start with the obvious. Chroma is a better retrieval engine than ours. The gap isn't close. One product covers dense vectors. Sparse BM25 and SPLADE too. Regex and metadata filters, too. Built on object storage. With automatic tiering. Plus published recall and latency numbers. We run pgvector. With a keyword leg beside it. That's fine for a checked corpus. It's not a distributed search engine, though. Their research is also doing real work. For the field. Context Rot, in July 2025, showed something real. Model accuracy degrades non-uniformly, as input length grows. That's the honest argument. Why retrieval still matters, in a million-token world. Context-1, in March 2026, is a 20B agentic search model. It decomposes queries and edits its own context. We don't have a research lab.

And their community: 27,000 stars, 90,000 dependent repos. That's a kind of insurance. One a small vendor can't offer.

Here's the push-back, in short. Look at who they list as clients. Capital One, UnitedHealthcare, Medwise. Those are corpora with rules attached. Chroma's own answer to enterprise risk: encryption at rest. With your keys. Plus PrivateLink, and now BYOC. Those are all controls. On the pipe and the disk. None of them tells you one thing. That a chunk held a member ID. None tells you which agent asked for it. None tells you one thing. Whether that agent was still allowed to ask. Their MCP server is a fair illustration. Twelve tools, full read and write. Nothing in the docs about who may call them. That's a reasonable design for a developer tool. A poor one for a claims corpus, though. Encryption protects the data. From someone who shouldn't have it. It does nothing about the agent that should.

Questions worth asking both of us

These are the questions we'd want answered if we were buying. Ask them on each call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes, it can. Each record commits to the one right before it. We sign and chain each checkpoint. Verification tells deletion apart. From truncation and tampering, each time. Run it against a sample chain at /verify. Chroma: they ship indexing monitoring and OpenTelemetry. That's observability. Not proof. We found no tamper-evident retrieval log. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks session access. On each checked tool call, always. A pulled grant bites on the next call. The context gets downgraded. Chroma's MCP server documents optional auth credentials. For self-hosted HTTP clients. No per-call authorization, though. If you pull an agent's key: ask one thing. How long does its open client keep querying?

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the subject's key material. That makes each ciphertext for that subject unreadable. All at once. It issues an ISO 27560 consent receipt, too. Actor identities in the chain carry HMAC commitments. Not names. The proof still checks out. Chroma lets you delete files from a collection. Ask what happens to the embeddings. The ones derived from those files. Ask, too, about anything already cached. A vector is still data about a person.

Do we have to drop Chroma to use DataShield?

No. Though most people end up choosing one place. For the chunks. Plenty of teams keep Chroma for the public corpus. The docs site, the code search. They run checked retrieval here. For the regulated one. What doesn't work: putting PHI in an unclassified collection. And hoping the access control arrives later.

Chroma has BYOC now. Doesn't that solve the residency problem?

It solves residency. We should say so plainly. Since February 2026, they'll run a bucket. Plus a metadata database. A Kubernetes cluster and a VPC. Inside your own account. The data plane stays in your setup. That's a real answer to "the data can't leave." It's not an answer to "prove this agent was allowed to read that document." Residency is about where the bytes sit. Authorization and proof are about who touched them.

Does DataShield have SOC 2?

Not yet. We won't imply otherwise, ever. Chroma has SOC 2 Type II on Cloud. We don't. What we publish instead: a threat model. A verifier anyone can run. And a security page that lists the gaps. Auth is live now. Guardian and Lighthouse have both been live since April 2026. Design-partner terms include source escrow. That way, a small vendor stays safe. Never a single point of failure. Details on the security page.

Other head-to-heads

Vector DB

DataShield vs Pinecone

Managed vector search at scale. Versus governance around the corpus.

 Vector DB

DataShield vs Qdrant

Rust-fast filtering. And the access control it leaves to you.

 Vector DB

DataShield vs Weaviate

Modules and hybrid search. Versus tokenized data and per-call authority.

 All

Every comparison

One honest scorecard per vendor.

See both mechanisms run, right in your browser. Break a live audit chain. Revoke an agent mid-session. Then decide what your vector store still owes you. Demo Center access is free with a work email.

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →