Chroma

Chroma's headline feature is that it needs nothing to start: pip install chromadb gives you an embedded, in-process vector store with no Docker container, no cloud account, and no API key. The same client code then points at a local server (chroma run) or at the managed Chroma Cloud without changing your application logic. Independent hands-on write-ups confirm this is a real advantage, not just marketing: one engineering team's review notes they reached for Chroma specifically "for rapid prototyping because it's easy to deploy on a local machine," and valued that it "lets you play with the results" during pipeline experimentation. It also supports dense-vector, sparse-vector (BM25/SPLADE) and hybrid search with metadata filtering in one API, which is more retrieval flexibility out of the box than most embedded stores offer.

The GitHub repo (chroma-core/chroma) has 29,091 stars and 2,448 forks as of today, is Apache 2.0 licensed, and is under genuinely active development — pull requests were merged the same day this was checked, not just starred and abandoned. The Python package on PyPI is at version 1.5.9, last released 2026-05-05; commit and PR activity in the repo has continued well past that date, so the slower package cadence looks like a release-process choice (separate CLI/JS release tracks exist) rather than a stalled project.

The open-source package is free and self-hostable under Apache 2.0. Chroma Cloud, the managed offering, publishes real numbers rather than "contact sales": Starter is $0/month plus usage (10 databases, 10 team members, community Slack), Team is $250/month plus usage (100 databases, 30 members, SOC 2-relevant support, $100 of included usage credit), and Enterprise is custom (unlimited databases/members, single-tenant clusters, BYOC, SLAs). Usage is metered at $2.50/GiB written, $0.33/GiB-month stored, $0.0075/TiB queried, and $0.09/GiB returned over the network. Chroma Cloud reached general availability in August 2025.

Chroma's self-hosted mode is a single-node database: there's no built-in replication, high availability, or native multi-tenancy in the OSS project. An independent hands-on account of running it for RAG in production reports that CPU, memory, and disk I/O "can turn into bottlenecks when handling larger datasets or more frequent retrieval requests," and that performance "can drop sharply" once concurrent query load increases — the tool is reported as strong for single-query, low-to-moderate-scale workloads and less predictable as concurrency and data volume grow toward the tens of millions of vectors. The same account notes Azure has no native Chroma support, requiring a manual Docker deployment. Chroma Cloud (the managed, Rust-backed distributed service) is the vendor's answer to this ceiling, but it's a separate product with its own pricing, not a config flag on the OSS version.

A security researcher (Ji'an Zhou) reported two remote-code-execution issues against chromadb in a GitHub issue opened 2026-03-24, after emailing the vendor on 2025-11-28 and getting one triage acknowledgment on 2025-12-16 with no resolution since. The first, tracked as CVE-2026-45829 (CVSS 4.0, rated Critical by GitHub Advisory), affects the legacy Python FastAPI server: an unauthenticated attacker can get arbitrary code execution by creating a collection with a crafted embedding-function config that sets trust_remote_code: true against a HuggingFace model reference — the auth check runs after the model is already loaded. It does not affect Chroma's default Rust server. Independent research firm HiddenLayer corroborates the finding and reports it was still unpatched as of version 1.5.8, with no fix released; their stated workaround is to run the Rust backend (the default) and not expose the Python FastAPI server to untrusted networks. The second issue in the same report — that a poisoned collection's stored embedding-function config can execute code on a client that fetches it without specifying its own embedding function — is backend-independent and, as of the last public comment (2026-06-04), also remained open with no vendor fix confirmed.

Separately from the OSS RCE report above, Chroma states that Chroma Cloud has completed a SOC 2 Type II examination, and its security page describes encryption in transit and at rest, SSO/MFA with role-based access, continuous vulnerability scanning, and annual third-party penetration testing. No subprocessor list or trust-center link is published alongside those claims.

Chroma raised an $18M seed round in April 2023 led by Astasia Myers at Quiet Capital, following an earlier undisclosed pre-seed in May 2022 led by AIX Ventures and Bloomberg Beta. No Series A or later round is publicly documented as of this check.