Chroma Watch

Institutional & network disclosure

This page exists so network administrators, filtering vendors, and security teams can review how Chroma Watch behaves on the wire. It does not override your organisation's acceptable-use policy: if streaming or entertainment categories are blocked, an explicit allowlist or policy exception is usually still required.

1. What Chroma Watch is

Chroma Watch is the signed-in streaming and playback area of Chroma. Access requires a valid Chroma account and session; it is not anonymous public file sharing.

2. Transport & identity

  • Browser traffic to the app is expected over HTTPS (TLS).
  • Authentication uses the same Chroma session mechanism as the rest of the product.
  • Core application HTML and APIs are served from your configured deployment host (for production, typically the same registrable domain as the main Chroma site).

3. Paths IT may need for allowlisting

If your policy permits this product class, these are the primary first-party paths used by the Watch experience (relative to https://chromaapp.online):

  • /watch and /watch/* (UI)
  • /api/watch/* (APIs, including playback negotiation)
  • /login, /signup, /auth/* (session establishment, if not already allowed for Chroma)

4. Third-party & dependent hosts

Depending on configuration, Chroma Watch may contact additional infrastructure typical of a modern web app:

  • Supabase project API and storage (example host: endvvkcwvbuthifjhcmz.supabase.co).
  • Media playback may use time-limited signed URLs or redirects to storage or approved embed providers as defined in your catalogue configuration.
  • Static assets or branding may load from configured CDNs or image hosts.

For a definitive list for your tenant, capture a short HAR or proxy log from a controlled test account while loading one title end-to-end, then compare to your policy.

5. Governance & user-facing policies

Terms, privacy, and account enforcement apply to Chroma as a whole. Use these for compliance review alongside this technical summary:

6. Security reporting

Vulnerability reports are accepted per /.well-known/security.txt.