SOC 2

SOC 2 is an auditing procedure designed to ensure that service providers securely manage data to protect the interests of your organization and the privacy of its clients. Developed by the American Institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data based on five “Trust Service Principles” —

1. Security: the system is protected against unauthorized access, both physical and logical
2. Availability: the system is available for operation and use as committed or agreed
3. Processing integrity: system processing is complete, accurate, timely, and authorized
4. Confidentiality: information designated as confidential is protected as committed or agreed
5. Privacy: personal information is collected, used, retained, disclosed, and destroyed in conformity with the commitments in the entity’s privacy notice and with the criteria set forth in Generally Accepted Privacy Principles

A SOC 2 report comes in two formats:

• Type I: measures policies and procedures that are in place at a specific moment in time
• Type II: measures the effectiveness of policies and procedures as operated over a specified time period, with a minimum of six months

MongoDB has a SOC 2 Type II report for MongoDB Atlas. The report describes MongoDB’s security controls for Atlas, and examines the suitability and effectiveness of those controls to meet the AICPA Trust Service Principles. It provides an independent assessment of how well MongoDB Atlas manages data with respect to security, availability, processing integrity, confidentiality and privacy.

MongoDB Atlas is in the scope of the SOC 2 Type II report.

The report covers all regions available with MongoDB Atlas.

Schellman and Company, LLC performs the MongoDB SOC 2 audits.

The MongoDB SOC 2 Type II report covers the period from September 1, 2018 to August 31, 2019. New reports are released annually.

An NDA is required to review the MongoDB SOC 2 Type II report. Please contact us to begin the process.