{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"mongodb","name":"MongoDB","domain":"mongodb.com","category":"Data platforms","one_liner":"MongoDB is a source-available, cross-platform, document-oriented database program","trust_center_url":null,"security_page_url":null,"url":"https://certreports.com/vendors/mongodb/security","last_verified_at":"2026-09-18T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"fedramp","framework_name":"FedRAMP","state":"verified_registry","state_label":"Verified","sentence":"Listed in the FedRAMP Marketplace as of 18 Sep 2026.","kind":"authorization","status_text":"FedRAMP Authorized","issued_at":"2023-01-18","expires_at":null,"period_start":null,"period_end":null,"auditor":"Schellman Compliance, LLC","impact_level":"Moderate","as_of":"2026-09-18","under_review":false,"source":"fedramp","url":"https://certreports.com/vendors/mongodb/fedramp","evidence":[{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2122150307","fetched_at":"2026-09-18 22:35:17.44827+00","content_hash":"db2d03fa40cba0e5287b9cc7361e71b7c30c7ca9d51efb7b540477105fb30c7b","wayback_url":null,"quote":"MongoDB - MongoDB Atlas for Government: FedRAMP Authorized","confidence":1},{"source_type":"registry","source_name":"FedRAMP Marketplace","url":"https://www.fedramp.gov/marketplace/products/FR2122150307","fetched_at":"2026-09-17 15:44:39.301965+00","content_hash":"395e7ad35dd25d1c547414140161c47ec22827b7ffae3bdbbd5256c38a3b940f","wayback_url":null,"quote":"MongoDB - MongoDB Atlas for Government: FedRAMP Authorized","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"third_party","state_label":"Reported","sentence":"Reported by the CSA STAR registry as of 17 Sep 2026, not confirmed.","kind":"certificate","status_text":"CSA STAR Level 2 certification on the registry, which is built on an ISO/IEC 27001 certification","issued_at":"2019-03-12","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/mongodb/iso-27001","evidence":[{"source_type":"registry","source_name":"CSA STAR registry (Level 2 basis)","url":"https://cloudsecurityalliance.org/star/registry/mongodb","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"mongodb, inc.: STAR Level 2 certification, Trusted Cloud Provider","confidence":1}]},{"framework":"csa-star","framework_name":"CSA STAR","state":"verified_registry","state_label":"Verified","sentence":"Listed in the CSA STAR registry as of 17 Sep 2026.","kind":"level2","status_text":"STAR Level 2 certification, Trusted Cloud Provider","issued_at":"2019-03-12","expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"csa_star","url":"https://certreports.com/vendors/mongodb/csa-star","evidence":[{"source_type":"registry","source_name":"CSA STAR registry","url":"https://cloudsecurityalliance.org/star/registry/mongodb","fetched_at":"2026-09-17 15:44:42.254747+00","content_hash":"e7f124247f5399c92ba048620a83c0b6cca1f9a2f97419f32566e462a3b1bda7","wayback_url":null,"quote":"mongodb, inc.: STAR Level 2 certification, Trusted Cloud Provider","confidence":1}]},{"framework":"dpf","framework_name":"EU-US Data Privacy Framework","state":"verified_registry","state_label":"Verified","sentence":"Listed in the Data Privacy Framework list as of 17 Sep 2026.","kind":"listing","status_text":"Active: EU-US Certification, SW-US Certification, UK Extension Certification","issued_at":"2016-10-26","expires_at":"2026-11-13","period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-17","under_review":false,"source":"dpf","url":"https://certreports.com/vendors/mongodb/security","evidence":[{"source_type":"registry","source_name":"Data Privacy Framework list","url":"https://www.dataprivacyframework.gov/participant/5847","fetched_at":"2026-09-17 15:49:11.653168+00","content_hash":"97e6900c0c7d9d46f30a6b4bcf46a32be1bc228ee5f10d5f98f94a6e4d56b776","wayback_url":null,"quote":"MongoDB, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification","confidence":1}]}],"brief":{"summary":"As of 17 Sep 2026, MongoDB is listed in the FedRAMP registry as FedRAMP Authorized, with the authorization originally issued 18 Jan 2023 by auditor Schellman Compliance, LLC. As of 17 Sep 2026, MongoDB is listed in the CSA STAR registry with a STAR Level 2 certification and Trusted Cloud Provider status, originally issued 12 Mar 2019, which the registry notes is built on an ISO/IEC 27001 certification. As of 17 Sep 2026, no separate public evidence was found confirming an independent ISO/IEC 27001 certificate for MongoDB beyond this CSA STAR registry reference. As of 17 Sep 2026, MongoDB is listed in the EU-US Data Privacy Framework registry with active EU-US, Swiss-US, and UK Extension certifications, originally issued 26 Oct 2016 and set to expire 13 Nov 2026. As of 17 Sep 2026, no public evidence was found regarding SOC 2 reports, HIPAA BAA offerings, or subprocessor listings for MongoDB.","bullets":["FedRAMP: listed in FedRAMP registry as FedRAMP Authorized (issued 18 Jan 2023; auditor Schellman Compliance, LLC), as of 17 Sep 2026.","CSA STAR / ISO/IEC 27001: listed in CSA STAR registry with STAR Level 2 certification and Trusted Cloud Provider status (issued 12 Mar 2019), noted as built on an ISO/IEC 27001 certification, as of 17 Sep 2026.","EU-US Data Privacy Framework: listed in DPF registry as Active for EU-US, Swiss-US, and UK Extension certifications (issued 26 Oct 2016; expires 13 Nov 2026), as of 17 Sep 2026."],"model":"claude-sonnet-5","generated_at":"2026-09-17 18:37:23.675034+00"},"legal_docs":[],"subprocessors":[],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-09-19T02:21:08.600Z"}