MongoDB
database · mongodb.com · last checked 2026-09-19
Identity
| Legal entity | MongoDB, Inc. |
|---|---|
| HQ | US |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | direct |
| Source | trust.mongodb.com · 2026-09-18 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| eu | Terms not stated | — | mongodb.com | 2026-09-18 |
eu: Reviewed 2026-09-18: recorded as terms-unstated because the page states no price or plan. Atlas clusters select a cloud provider and region at creation, with European regions available on AWS, Google Cloud and Azure. Note this is the Atlas service; MongoDB's own trust portal, which holds the subprocessor list, remains gated.
Subprocessor chain
No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| ENS | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| FedRAMP | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| GDPR | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| HDS | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| HIPAA | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| HITRUST | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| IRAP | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| ISO27001 | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| ISO27017 | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| ISO27018 | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| ISO9001 | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| PCI | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| SOC2T2 | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
| TISAX | claimed | Badge shown on the trust portal without access. | trust.mongodb.com | 2026-09-18 |
Claimed means the vendor asserts the certification on its own page and we have not seen the certificate. That is a distinction an auditor makes, so we make it too.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| MongoDB Server 8.0 | 60 months | Declared | unknown | mongodb.com | 2026-09-18 |
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| trust-center | Gated | partial | 200 | 2026-09-18 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-09-19 | EU data location unstated → available-terms-unstated Note rewritten | we read a better page | mongodb.com |