Atlas Compliance Certifications
Parent: MongoDB Compliance and Regulatory · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-d624439a89da
↓ Facts as markdownall context files
Source-anchored research for Atlas Compliance Certifications. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Comparisons and alternatives
- MongoDB lists Atlas assurance under ISO/IEC 27001:2022, SOC 2 Type II, PCI DSS, and CSA STAR; these labels identify different assurance frameworks rather than a single universal compliance certificate. (high confidence) (verified as of 2026-10-24) [source]
- MongoDB labels Atlas for Government (US) as a dedicated FedRAMP Moderate Authorized environment. That public statement identifies the government environment rather than establishing the same authorization for every commercial Atlas deployment. (high confidence) (verified as of 2026-10-24) [source]
Facts and statements
- MongoDB states that ISO 27017 and ISO 27018 controls are incorporated into its ISO 27001 certification. The stated ISMS scope excludes the underlying third-party IaaS environments, and MongoDB names Schellman and Company, LLC as the auditor. (low confidence) (verified as of 2026-10-24) [source]
- CSA lists MongoDB Cloud Platform, including Atlas, with STAR Level 2 Certification v4.0 created or renewed on May 19, 2026. The same entry separately lists a Level 1 CAIQ self-assessment; Level 1 and Level 2 are different assurance levels. (high confidence) (verified as of 2026-05-19) [source]
- MongoDB directs customers to its Customer Trust Portal for attestations, compliance reports, and certificates, including ISO documentation. (high confidence) (verified as of 2026-10-24) [source]
- HIPAA-ready does not mean HHS-certified: MongoDB explicitly disclaims a recognized HIPAA certification, and HHS says it does not endorse or recognize private Security Rule certifications. (high confidence) [source]
- MongoDB describes a Schellman independent HIPAA/HITECH examination whose stated information-security-program conformity date is September 30, 2025. The report is available to organizations that complete an NDA. (low confidence) (verified as of 2025-09-30) [source]
- A Reddit Atlas customer reported requesting SOC 2 documents three times without a response. The thread later says the customer obtained what they needed. This is one anecdote about document access, not evidence that Atlas lacks a SOC 2 report. (low confidence) [source]
- The How to Harden guide explicitly attributes its Atlas certification list to MongoDB and labels itself AI drafted. Treat that list as a secondary pointer, not an independent audit of Atlas certification status. (low confidence) (verified as of 2026-08-08) [source]
- MongoDB lists Atlas within MongoDB Cloud ISO/IEC 27001:2022 certification; the certified subject is its information security management system (ISMS). (high confidence) (verified as of 2026-10-24) [source]
- The registry distinguishes its Level 1 CAIQ self-assessment v4.0.2 from Level 2 STAR Certification v4.0. Both MongoDB records show May 19, 2026 renewal; the Level 2 scheme combines ISO/IEC 27001 management-system requirements with the CSA Cloud Controls Matrix. (low confidence) (verified as of 2026-05-19) [source]
- MongoDB publishes information about a SOC 2 Type II report covering Atlas. Its SOC page describes an independent assessment of security, availability, and confidentiality controls. (high confidence) (verified as of 2026-10-24) [source]
- MongoDB states that its SOC 2 report covers all regions used by its cloud services, excludes beta and preview features, is audited by Schellman, and is released biannually. Report access requires an active NDA or current active customer status. (low confidence) (verified as of 2026-10-24) [source]
Children
- No children recorded.