MongoDB Compliance and Regulatory

Parent: MongoDB Expert Knowledge · Published reference · snapshot 2026-09-08 · skill mongodb-operations-expert/references/mongodb-compliance.md

↓ Facts as markdown all context files

| Framework | Status | Notes |

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Shared Responsibility Model

MongoDB manages: physical security, host OS patching, database process, network isolation, encryption at rest (default), TLS in transit, automated backups, availability zones. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#shared-responsibility-model]
Customer manages: database users and access control, application-layer authorization, network access lists, audit log configuration, data classification, application-level encryption (CSFLE/QE). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#shared-responsibility-model]

BAA (Business Associate Agreement)

A BAA is required for any covered entity or business associate storing PHI in Atlas. MongoDB offers a BAA for Atlas. The BAA covers Atlas-managed clusters only. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#baa-business-associate-agreement]

PHI Protection Patterns

Encryption at rest: Default AES-256 (MongoDB-managed) or BYOK (AWS/Azure/GCP KMS) for additional control [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]
Encryption in transit: TLS 1.2+ required; TLS 1.3 supported [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]
Field-level encryption: Use Client-Side Field Level Encryption (CSFLE) or Queryable Encryption (QE) for PHI fields that need column-level protection [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]
Access control: Dedicated database users per application component; minimal roles (principle of least privilege) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]
Audit logging: Enable Atlas database auditing - log all authenticate, authCheck, createCollection, dropDatabase events [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]
Backup compliance: Enable Backup Compliance Policy (BCP) to prevent backup deletion [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#phi-protection-patterns]

HIPAA-Required Cluster Features

M10+ dedicated cluster (required for HIPAA) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#hipaa-required-cluster-features]
Encryption at rest enabled (default or BYOK) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#hipaa-required-cluster-features]
Database auditing enabled [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#hipaa-required-cluster-features]
IP allowlist or private endpoints (no 0.0.0.0/0) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#hipaa-required-cluster-features]
MFA on Atlas user accounts (all project members) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#hipaa-required-cluster-features]

Applicable Atlas Requirements

Requirement 2 (Secure Configuration): Use private endpoints or VPC peering; no default/test database users; rename admin user. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
Requirement 3 (Cardholder Data Protection): [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
- Never store full PAN in plaintext - use Queryable Encryption or CSFLE with AES-256 for PAN fields [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
- Use $regex on QE fields to verify card data format without decrypting [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
- Purge SAD (Sensitive Authentication Data) after authorization - TTL index on SAD fields [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
Requirement 4 (Encryption in Transit): TLS 1.2+ for all client connections. Atlas enforces TLS by default. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
Requirement 7 (Restrict Access): Principle of least privilege for database users. Custom roles scoped to specific databases and collections. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
Requirement 8 (Authentication): MFA on Atlas UI and API; SCRAM-SHA-256 or X.509 for database access; no shared credentials. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]
Requirement 10 (Audit Logging): Atlas database auditing must be enabled. Audit: authenticate, authCheck, createUser, dropUser, createCollection, dropCollection, createIndex. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#applicable-atlas-requirements]

FedRAMP High (AtlasGov)

AtlasGov is a separate deployment of MongoDB Atlas on Azure Government regions designed to meet FedRAMP High, DoD IL2/IL4/IL5 requirements. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#fedramp-high-atlasgov]
- Control plane: cloud.mongodbgov.com (separate from cloud.mongodb.com) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#fedramp-high-atlasgov]
- Supported regions: AZURE_US_GOV_VIRGINIA, AZURE_US_GOV_ARIZONA [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#fedramp-high-atlasgov]
- Terraform: Set MONGODB_ATLAS_GOV_BASE_URL=https://cloud.mongodbgov.com/ or use mongodbatlas_cluster with government_region_name [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#fedramp-high-atlasgov]
AtlasGov is not accessible from standard Atlas accounts - requires a separate Atlas for Government account. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#fedramp-high-atlasgov]

Key Obligations

Data Residency: Data must stay in the EU jurisdiction. Options: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]
- Single-region Atlas cluster in EU: Simplest; all data in EU regions (e.g., EU_WEST_1, EU_CENTRAL_1) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]
- Atlas Global Clusters with EU zone: Data with EU location prefix physically stored in EU regions only; cross-zone scatter-gather queries blocked at app layer [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]
Right to Erasure (Right to be Forgotten): [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]
Data Processing Agreement (DPA): MongoDB offers a DPA for Atlas. Required for EU data controllers. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]
Data Portability: Use mongoexport or Atlas Data Federation $out to S3 to generate user data exports. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#key-obligations]

Backup Compliance Policy (BCP)

BCP locks backup settings across all clusters in a project - prevents backup deletion and modification without multi-party authorization. Recommended for HIPAA, PCI DSS, and SOC 2. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#backup-compliance-policy-bcp]
Once enabled, BCP cannot be disabled without contacting MongoDB Support and verifying the authorized contact. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#backup-compliance-policy-bcp]

Database Auditing for Compliance

Enable Atlas database auditing (M10+) to capture: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]
SIEM Integration: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]
- Atlas → S3 → AWS Security Hub / Splunk / Sumo Logic [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]
- Atlas audit log export via Admin API (hourly pull) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]
- Atlas Sentinel integration (see mongodb-atlas-azure) [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]
- MongoDB Atlas Datadog integration → Datadog SIEM [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#database-auditing-for-compliance]

Queryable Encryption for Compliance-Sensitive Fields

For HIPAA, PCI, or GDPR-sensitive fields that must be queryable but not visible to DBA: [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#queryable-encryption-for-compliance-sensitive-fields]
Queryable Encryption protects data from: database administrator access, cloud provider access (keys in customer KMS), memory sniffing (keys are in the client). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#queryable-encryption-for-compliance-sensitive-fields]

Compliance-Specific Feature Gating

Key implication: Any regulated workload (HIPAA, PCI, FedRAMP, SOC 2 with database scope) requires M10+ dedicated clusters. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#compliance-specific-feature-gating]

Anti-Patterns

Storing PHI or PAN on M0/Flex: Non-compliant; shared infrastructure; no auditing or BYOK [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#anti-patterns]
Not enabling database auditing: Cannot demonstrate access controls to auditors without audit logs [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#anti-patterns]
Miscounting GDPR backup scope: Atlas backups retain deleted data for the configured retention period; DPA must account for this [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#anti-patterns]
Using 0.0.0.0/0 access list in production for any regulated workload: PCI Req 1, HIPAA, FedRAMP all require network restriction [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#anti-patterns]
Not setting up Backup Compliance Policy before going live: Once live data exists, BCP requires additional authorization steps; set it up pre-launch [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#anti-patterns]

References

Atlas HIPAA Compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]
Atlas PCI DSS Compliance [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]
Atlas FedRAMP / AtlasGov [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]
Atlas GDPR [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]
Atlas Backup Compliance Policy [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]
Queryable Encryption [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-compliance/#references]

Where this helps

Standing up a new Atlas deployment that must handle regulated data (PHI, PAN, EU personal data) and needs to map compliance requirements to concrete cluster configuration. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Preparing for a HIPAA, PCI DSS, or SOC 2 audit and needing to demonstrate which controls MongoDB manages under the shared responsibility model versus which the customer must configure. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Choosing between standard Atlas and AtlasGov for a workload that must meet FedRAMP High or DoD Impact Level requirements. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Deciding how to protect individual sensitive fields (PAN, PHI) so they remain queryable without exposing them to database administrators or cloud provider access. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

How to apply this

Walk a new regulated workload through the shared responsibility model line by line — physical security and TLS are MongoDB's job, but access control, audit configuration, and data classification are the customer's. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Enable Backup Compliance Policy before go-live, since enabling it after live data exists requires additional authorization steps with MongoDB Support. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Configure Queryable Encryption on PAN or PHI fields that need to remain queryable but hidden from DBA-level and cloud-provider-level access. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Set up SIEM export of Atlas database audit logs (via S3, the Admin API, or a Datadog integration) before an auditor asks for evidence of access controls, not after. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Common mistakes

Storing PHI or PAN data on M0/Flex shared tiers, which lack the dedicated infrastructure, auditing, and BYOK support regulated workloads require. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Not enabling database auditing, leaving no way to demonstrate access controls to an auditor after the fact. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Miscounting GDPR backup scope — Atlas backups retain deleted data for the configured retention window, and the Data Processing Agreement must account for that retained copy. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Leaving a 0.0.0.0/0 IP access list in place for a regulated workload, when PCI DSS Requirement 2, HIPAA, and FedRAMP all require restricting network access. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Known issues

Regulated workloads (HIPAA, PCI, FedRAMP, database-scoped SOC 2) require M10+ dedicated clusters — the compliance features simply aren't available on shared tiers. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
AtlasGov runs on a completely separate control plane (cloud.mongodbgov.com) from standard Atlas (cloud.mongodb.com) and requires a distinct Atlas for Government account — it isn't reachable from a standard Atlas login. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Once Backup Compliance Policy is enabled, it cannot be disabled without contacting MongoDB Support and verifying the authorized contact — it's a one-way door operationally. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
A BAA only covers Atlas-managed clusters, so any self-managed or non-Atlas MongoDB deployment handling PHI needs its own compliance arrangement. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Children

Atlas Compliance Certifications (frontier, viability 2.85 / 5, below research gate)
FedRAMP and AtlasGov (frontier, viability 3.33 / 5)
HIPAA BAA and ePHI Configuration (frontier, viability 3.55 / 5)
PCI DSS Scoping and Tokenization (frontier, viability 3.23 / 5)
Data Residency and EU Sovereignty (frontier, viability 3.48 / 5)
Atlas Audit Logging (frontier, viability 3.55 / 5)
Encryption Requirements (At-Rest, In-Transit, Field-Level) (frontier, viability 3.17 / 5, below research gate)
BYOK Key Management (frontier, viability 3.55 / 5)
Atlas Access Control and RBAC (frontier, viability 3.42 / 5)
Compliance Gaps and Shared Responsibility (frontier, viability 3.15 / 5, below research gate)
Audit-Ready Architecture and Evidence Collection (frontier, viability 2.75 / 5, below research gate)
Common Audit Findings and Remediation (frontier, viability 2.48 / 5, below research gate)

Frontier under this node: Atlas Access Control and RBAC (3.42), Atlas Compliance Certifications (2.85), Audit-Ready Architecture and Evidence Collection (2.75), BYOK Key Management (3.55), Common Audit Findings and Remediation (2.48), Compliance Gaps and Shared Responsibility (3.15), Data Residency and EU Sovereignty (3.48), Encryption Requirements (At-Rest, In-Transit, Field-Level) (3.17), FedRAMP and AtlasGov (3.33), HIPAA BAA and ePHI Configuration (3.55), PCI DSS Scoping and Tokenization (3.23)

← the whole tree · 3D view· how to read this page