MongoDB Atlas is designed to manage foundational security and operational tasks, enabling organizations to focus on application innovation rather than infrastructure management. This is achieved through a shared responsibility model in which both parties have complementary duties to ensure the safety and integrity of the data environment: the provider is responsible for the security and operational integrity of the platform, while the customer is responsible for security, configuration, and management of their specific deployment.
As a modern multi-cloud database, MongoDB Atlas combines a flexible document model with a suite of integrated data services to simplify application development. Engineered for enterprise-grade resiliency, workload isolation, and observability, Atlas is the most effective way to deploy MongoDB. It supports seamless multi-region and multi-cloud configurations across 125+ cloud regions on AWS, Azure, and Google Cloud.
Security is integrated into the core of Atlas through built-in security controls and customizable guardrails. This framework simplifies the customer’s requirements by handling platform-level complexities while maintaining their ability to configure the environment for specific needs. These built-in protections include authentication, authorization, and encryption for data at rest and in transit, as well as automated, zero-downtime security patching. To further protect their environment, customers can enable advanced features such as Queryable Encryption and hardened network protections, such as private endpoints and VPC peering. MongoDB also conducts regular security hardening of the Atlas environment, including penetration testing with world-class security vendors and by utilizing a security bug bounty program.
Atlas resources are managed through an organization- and project-based hierarchy for streamlined administration. Within this framework, customers are responsible for establishing their initial environment. This includes creating users and roles, selecting one or more cloud providers and regions, and choosing cluster types.
MongoDB maintains an extensive portfolio of global and regional compliance certifications and undergoes frequent independent audits to verify the company’s ongoing commitment to platform security and resilience. Detailed compliance documentation and audit reports are available for review under a non-disclosure agreement (NDA) through the MongoDB Customer Trust Portal. Professional guidance and support are available for customers who want to follow best practices for their specific configurations and policy decisions through MongoDB’s Professional Services.
Cloud Shared Responsibility Model
Achieving a robust security and operational posture is a collaborative effort defined by clear ownership between MongoDB and its customers. The following table provides a transparent breakdown of these responsibilities, distinguishing between the managed platform and infrastructure services provided by MongoDB and the customer's specific configuration and policy decisions.
How MongoDB Protects Customers and Their Data
While the Shared Responsibility Model defines ownership, the following section provides a detailed look at the specific security controls and architectural standards MongoDB employs to secure the Atlas platform. These capabilities provide transparency into how MongoDB protects the world’s most sensitive workloads. For additional technical insight, refer to MongoDB’s technical and organizational security measures for Atlas.
