How many subprocessors does MongoDB use?

MongoDB lists 27 subprocessors on its published list, including Amazon Web Services, Inc., Google LLC, Microsoft Corp, Cloud Provider, and MongoDB, Inc. and 22 more.

Where does MongoDB process customer data?

The subprocessors named by MongoDB are located in CA, San Francisco, Canada, United States, Australia, and Brazil and 12 other locations, as stated on its list.

How quickly does MongoDB report a personal data breach to customers?

According to its DPA, MongoDB reports a personal data breach to customers without undue delay, with no set deadline: “We will notify you without undue delay if we become aware of a personal data breach affecting Customer Personal Data.”

How much notice does MongoDB give before adding a subprocessor?

MongoDB's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.”

How does MongoDB transfer personal data outside the EU?

MongoDB's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “MongoDB participates in and certifies compliance with the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (together, the "DPF").”

When was MongoDB's subprocessor list last checked?

ClauseTrail last checked MongoDB's subprocessor list on September 26, 2026. Lists are re-checked daily.

How do I find out when MongoDB adds or removes a subprocessor?

ClauseTrail monitors MongoDB's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

MongoDB Subprocessors List (September 2026): Changes and History

MongoDB subprocessors (September 2026)

#	Subprocessor	Purpose	Location	Data
1	Amazon Web Services, Inc.	Cloud Provider	—	MongoDB Atlas runs on top of AWS, GCP, and Microsoft Azure. These cloud providers host the personal data you store in the Cloud Services.
2	Google LLC	Cloud Provider	—	" "
3	Microsoft Corp	Cloud Provider	—	" "
4	Cloud Provider	Google LLC	—	—
5	MongoDB, Inc.	—	United States	—
6	MongoDB Canada, Inc.	—	Canada	—
7	MongoDB Australia Pty Ltd.	—	Australia	—
8	MongoDB Israel Inc.	—	Israel	—
9	MongoDB France SARL	—	France	—
10	MongoDB Software India Private Limited	—	India	—
11	MongoDB Italy S.R.L	—	Italy	—
12	MongoDB España, S.L.	—	Spain, Portugal	—
13	MongoDB Serviços de	—	Brazil	—
14	MongoDB Singapore Pte. Ltd.	—	Singapore	—
15	MongoDB Poland	—	Poland	—
16	MongoDB Deutsche GmbH	—	Germany	—
17	MongoDB UK Limited	—	United Kingdom	—
18	Baseten Labs, Inc.	Inference services for the optional embedding and reranking model services included in the Cloud Services	United States	—
19	Okta, Inc.	Authentication Services	San Francisco, CA	Okta receives and stores basic information in the course of authenticating you into the service via federated single sign in (e.g, first and last name, business contact info, email).
20	Twilio, Inc.	2FA and SMS Alerts	San Francisco, CA	If you turn on two-factor authentication or SMS alerts, Twilio receives basic info to provide you authentication codes and text alerts (e.g., phone number).
21	Salesforce.com, Inc.	Support Portal	San Francisco, CA	If you engage in support within the Salesforce portal, Salesforce receives basic info related to your case and subscription (e.g., name, email, phone number, company, country, Atlas ID). If you include other personal data in your support tickets (e.g., snippets of database logs, query outputs, etc.), this information would also be processed by Salesforce.
22	Intercom R&D Unlimited Co.	Chat Support	San Francisco, CA	If you initiate a chat in the Atlas UI chatbot, Intercom receives basic info related to your case (e.g., name, email, phone number, company, country, Atlas ID). If you include other personal data in your support chats (e.g., snippets of database logs, query outputs, etc.), this information would also be processed by Intercom.
23	Talkdesk, Inc.	Voice Support	San Francisco, CA	If you engage in telephone support, Talkdesk receives basic contact info (e.g., name, phone number).
24	Box, Inc.	File Sharing for Remote Consulting Services	Redwood City, CA	If you choose to share files with us during the delivery of remote Consulting Services, Box receives basic contact info as well as any personal data included in those files.
25	Coveo Software Corp.	Support Search Functionality	Quebec City, Canada	Coveo is a federated search engine that allows you to search for basic support info as well as your historical and active support tickets. If you engage in support within the Salesforce portal, those support tickets would be integrated into Coveo. If you include other personal data in your support tickets (e.g., snippets of database logs, query outputs, etc.), this information would also be processed by Coveo.
26	Fastly, Inc.	Content Delivery Network for Support	San Francisco, CA	If you engage in support within the Salesforce portal, information transmitted to and from MongoDB will be transmitted through Fastly’s servers. If you include other personal data in your support tickets (e.g., snippets of database logs, query outputs, etc.), this information would also be processed by Fastly.
27	Stripe Inc.	Payment Processor	San Francisco, CA	Stripe receives billing information, such as your name, credit card details, and address, if you pay for MongoDB services by credit card.

Key DPA terms at MongoDB

What MongoDB's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“We will notify you without undue delay if we become aware of a personal data breach affecting Customer Personal Data.”
DPA, www.mongodb.com ↗
Notice of a new subprocessor: 30 days ahead

“We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.”
DPA, www.mongodb.com ↗
Transfers outside the EU: Standard contractual clauses and the EU–US Data Privacy Framework

“MongoDB participates in and certifies compliance with the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (together, the "DPF").”

“"Standard Contractual Clauses" means, as the circumstances may require, the applicable module(s) of the Standard Contractual Clauses approved by the European Commission in decision 2021/914”
DPA, www.mongodb.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Upon termination of your MongoDB Agreement or upon your request, MongoDB will delete any Customer Personal Data not deleted by Customer, unless we are legally required to store the Customer Personal Data.”
DPA, www.mongodb.com ↗
Audit rights: Through certifications and audit reports only

“MongoDB will make available to Customer (or Customer's independent, third-party auditor) information regarding MongoDB's compliance with the security obligations set forth in this DPA in the form of third-party certifications and audits.”
DPA, www.mongodb.com ↗

Documents we track for MongoDB

DPA: checked September 26, 2026 changed September 26, 2026 www.mongodb.com ↗
Privacy policy: checked September 26, 2026 changed September 26, 2026 www.mongodb.com ↗
Subprocessor list: checked September 26, 2026 www.mongodb.com ↗
Terms of service: checked September 26, 2026 changed September 26, 2026 www.mongodb.com ↗

Change history

Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

MongoDB subprocessors FAQ

How many subprocessors does MongoDB use?: MongoDB lists 27 subprocessors on its published list, including Amazon Web Services, Inc., Google LLC, Microsoft Corp, Cloud Provider, and MongoDB, Inc. and 22 more.
Where does MongoDB process customer data?: The subprocessors named by MongoDB are located in CA, San Francisco, Canada, United States, Australia, and Brazil and 12 other locations, as stated on its list.
How quickly does MongoDB report a personal data breach to customers?: According to its DPA, MongoDB reports a personal data breach to customers without undue delay, with no set deadline: “We will notify you without undue delay if we become aware of a personal data breach affecting Customer Personal Data.”
How much notice does MongoDB give before adding a subprocessor?: MongoDB's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.”
How does MongoDB transfer personal data outside the EU?: MongoDB's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “MongoDB participates in and certifies compliance with the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (together, the "DPF").”
When was MongoDB's subprocessor list last checked?: ClauseTrail last checked MongoDB's subprocessor list on September 26, 2026. Lists are re-checked daily.
How do I find out when MongoDB adds or removes a subprocessor?: ClauseTrail monitors MongoDB's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.