Encryption Requirements (At-Rest, In-Transit, Field-Level)
Parent: MongoDB Compliance and Regulatory · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-3e9502b80e34
↓ Facts as markdownall context files
Source-anchored research for Encryption Requirements (At-Rest, In-Transit, Field-Level). Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- Automatic client encryption adds a query-analysis dependency such as crypt_shared or mongocryptd; explicit encryption does not require either component. mongocryptd marks operations for encryption and does not perform the cryptography itself. (high confidence) [source]
- Automatic Queryable Encryption requires a compatible driver and a query analysis component. Treat packaging that component and maintaining encryption-aware clients as application deployment work when estimating the cost of an encryption requirement. (medium confidence) (verified as of 2026-10-23) [source]
Measurements and reference values
- Queryable Encryption supports only a subset of database operations and requires operational care: the limitations guide calls for manual metadata compaction above 1 GB, while schema guidance says changing encrypted/queryable fields requires rebuilding the schema and re-creating the collection. (high confidence) (verified as of 2026-10-14) [source]
- Queryable Encryption introduces operational work beyond selecting a cluster tier: MongoDB recommends manually compacting metadata collections once they exceed 1 GB to reduce their size and improve performance. The documentation does not provide a universal storage multiplier or latency overhead percentage. (low confidence) (verified as of 2026-10-14) [source]
Problems, failure modes and limitations
- Queryable Encryption supports only a subset of query operations, excludes secondary reads, and cannot coexist with CSFLE on the same collection. Increasing the Atlas tier does not by itself remove these documented feature limitations. (low confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- Atlas automatically applies cloud-provider AES-256 disk encryption to cluster storage and snapshot volumes and requires TLS for database connections; the baseline disk encryption and TLS cannot be disabled. The documented baseline applies across Atlas clusters rather than being presented as a dedicated-tier upgrade. (high confidence) (verified as of 2026-10-14) [source]
- The automatic-versus-explicit encryption distinction can affect edition and application costs: MongoDB's client-side encryption specification classifies automatic encryption as an enterprise feature, while explicit encryption/decryption and automatic decryption are community features. Percona independently demonstrates explicit CSFLE on Percona Server for MongoDB 4.4. (high confidence) (verified as of 2026-10-23) [source]
Facts and statements
- At-rest encryption and TLS protect different stages of the data lifecycle from client-side field encryption. CSFLE encrypts selected sensitive fields before transmission and decrypts them on the client; server-side storage encryption alone does not provide that client-held plaintext boundary. (high confidence) [source]
- Atlas explicitly entitles all Atlas users to automatic client-side field-level encryption. Percona's worked CSFLE example distinguishes automatic encryption on Enterprise/Atlas from explicit encryption on Community; automatic CSFLE entitlement should therefore not be treated as evidence of an M10 minimum. (high confidence) (verified as of 2026-10-14) [source]
- Queryable Encryption's compatibility matrix lists MongoDB 7.0 or later replica sets and sharded clusters, excludes standalone instances, and supports automatic encryption on Atlas and Enterprise Advanced but only explicit encryption on Community Edition. This is an edition/topology gate; the matrix does not specify an Atlas M10 minimum. (high confidence) (verified as of 2026-10-14) [source]
- Queryable Encryption increases storage and write work through encrypted metadata collections and indexes. The documentation describes two metadata collections per encrypted collection and index updates on writes; this is a capacity-planning cost driver, but these sources do not establish a universal storage multiplier or latency percentage. (high confidence) (verified as of 2026-10-14) [source]
- For Queryable Encryption range queries, denser indexing trades additional metadata storage for query performance; increasing contention can improve writes on repeated values while making finds slower. Benchmark the intended query mix before translating encryption requirements into cluster capacity. (low confidence) (verified as of 2026-10-14) [source]
- Production field-encryption planning must include secure key custody outside the demonstration local-key setup. MongoDB's PHP guide and Percona's implementation tutorial both treat local keys as a development/example convenience and recommend a supported external provider for production. (high confidence) [source]
- Encryption claims must name the attacker model. ETH Zurich researchers' USENIX Security 2023 analysis recovered query/data information from the studied Queryable Encryption implementation using server logs and similarly distributed auxiliary data. Current MongoDB limitations explicitly exclude persistent adversaries and attackers holding both database snapshots and query transcripts/logs; the historical paper alone does not establish an exploitable flaw in today's release. (high confidence) [source]
- Queryable Encryption supports new collections only and does not automatically migrate plaintext or CSFLE collections. Existing documents must be inserted into the new encrypted collection individually, with CSFLE documents first decrypted. Budget migration work separately from steady-state cluster capacity. (low confidence) (verified as of 2026-10-14) [source]
- Queryable Encryption redacts diagnostic output and omits selected encrypted-collection operations from query logs, limiting server-side performance investigation. MongoDB recommends third-party application performance monitoring to measure those operations; include that observability work in cost estimates. (high confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.