transformIdentifiers HMAC privacy mode
Parent: MongoDB Explain Plans, Query Planner and Plan Cache · Published reference · snapshot 2026-10-22 · skill ranked-a333aac1
↓ Facts as markdownall context files
Source-anchored research for transformIdentifiers HMAC privacy mode. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- Protect hmacKey separately from exported query statistics. MongoDB’s README labels the subtype-8 key as sensitive, and NIST defines HMAC around a shared secret key, making key custody part of the privacy boundary. (high confidence) [source]
How it works
- Treat this as scoped pseudonymization, not an anonymity guarantee. MongoDB’s tokenization preserves relationships among repeated identifiers, while ICO guidance distinguishes pseudonymized data from anonymized data and says pseudonymized data can remain personal data when additional information enables attribution. (medium confidence) (verified as of 2026-10-22) [source]
Comparisons and alternatives
- transformIdentifiers does not anonymize every $queryStats output field. MongoDB leaves MQL operators, aggregation parameter names, and client metadata such as application, driver, and operating-system details readable; it normalizes field values to their types instead of HMACing them, and says it does not store user field values. (high confidence) (verified as of 2026-10-22) [source]
- MongoDB Jira records why the project chose transform terminology: HMAC creates a tokenized identifier rather than deleting it as redaction would imply. The follow-up parameter change records the nested transformIdentifiers document with algorithm and hmacKey, replacing the earlier applyHmacToIdentifiers name. (high confidence) [source]
Facts and statements
- The optional $queryStats transformIdentifiers document currently requires algorithm hmac-sha-256 and a subtype-8 BinData hmacKey. MongoDB applies HMAC-SHA-256 to document field names, collection names, and database names. (high confidence) (verified as of 2026-10-22) [source]
- MongoDB’s README says the transform HMACs field, collection, and database names, but leaves the application name unchanged. It calls the result one-way tokenization: repeated identifiers remain recognizable without exposing their original names. An InfluxData proposal cites MongoDB’s approach and describes using a customer-held key with a local mapping for support. (high confidence) (verified as of 2026-10-22) [source]
- For transformed reads, current MongoDB documentation requires both queryStatsRead and queryStatsReadTransformed; the built-in clusterMonitor role includes both. A MongoDB design ticket explains that the project intended separate authorization for transformed and non-tokenized reads. (high confidence) (verified as of 2026-10-22) [source]
- MongoDB Atlas documentation says Atlas periodically runs $queryStats for product analytics and uses a unique HMAC key per Atlas organization; it states that collected query-stat data is retained for four years. (low confidence) (verified as of 2026-10-22) [source]
Children
- No children recorded.