Protegrity & MangoDB
overview
Protect sensitive data in MongoDB without slowing development, redesigning schemas, or rewriting applications. Protegrity’s Data Security Gateway (DSG) gives teams a practical way to add field-level tokenization, masking, and encryption to MongoDB environments by enforcing protection in the data path. Deployed on-premises or in the cloud in front of the MongoDB cluster, DSG transparently intercepts driver and REST traffic, applies policies from Protegrity’s Policy Manager, and returns the right level of data access based on the authenticated user or service.
This approach is especially important for MongoDB because its document model does not expose the same in-database stored procedures or UDFs commonly available in SQL engines. Instead of forcing teams to modify applications or embed protection logic across services, Protegrity centralizes enforcement at the gateway. Existing MongoDB drivers, ORMs, and client applications continue to operate as designed, while restricted users see protected values and authorized users see clear text according to policy.
Key Integration Feature
The Data Security Gateway is the core integration feature that enables MongoDB protection without native UDF support. DSG acts as a policy-enforcing proxy between applications and the MongoDB cluster, authenticating each caller and applying protect or unprotect operations to specific fields in flight. The result is a scalable protection model that helps technical teams reduce sensitive data exposure without changing MongoDB schemas, drivers, or application code.
Features & Capabilities
Transparent Gateway Deployment: DSG sits in front of MongoDB as a cluster, intercepting driver and REST traffic without requiring changes to MongoDB itself.
01
Field-Level Protection for MongoDB Documents
Why It Matters
Teams can add field-level protection to MongoDB faster and with less engineering disruption because the gateway enforces protection in transit rather than pushing security logic into every application, collection, or index.
How It Works
Applications point their MongoDB connection string at the DSG endpoint instead of directly at the cluster. DSG forwards traffic to MongoDB after applying the configured ruleset.
02
Gateway Integration for Drivers and ORMs
Why It Matters
Security and compliance teams gain a single control point for defining, auditing, and updating policy across MongoDB workloads, reducing the risk of inconsistent protection logic across services.
How It Works
Policy Manager distributes signed rulesets to the DSG cluster, which enforces them locally on every request without a round trip to Policy Manager for each transaction.
03
Policy-Based Access to Shared Collections
Why It Matters
A single MongoDB collection can safely support different users, services, and access levels without duplicating data or creating separate protected and unprotected environments.
How It Works
When a restricted user queries a protected collection through DSG, sensitive fields return as tokenized values. A privileged user making the identical query receives the unprotected value, according to Protegrity policy.
04
Centralized Ruleset Management
Why It Matters
Teams can extend how documents are inspected, transformed, or routed as they pass through the gateway, supporting more advanced protection and workflow requirements beyond standard protect and unprotect calls.
How It Works
A DSG UDF written in Python is registered in the gateway’s ruleset and invoked inline as documents move between the application and MongoDB.
05
Protection During Reads and Writes
Why It Matters
Sensitive fields should be protected before they are stored and revealed only when an approved user or service requires access. Applying policy in both directions reduces reliance on separate application-side controls.
How It Works
For supported write operations, DSG protects selected fields before forwarding the document to MongoDB. For reads, the gateway evaluates the caller and returns the permitted clear-text, masked, encrypted, or tokenized representation.
Architecture &
Sample Data Flow
In a protected MongoDB deployment, applications and analysts route their driver traffic through the Data Security Gateway rather than connecting directly to MongoDB. DSG authenticates the caller, evaluates the issued ruleset for that identity, and applies protect or unprotect operations to the fields covered by policy before forwarding the request to MongoDB or returning its response.
This architecture gives teams a clean separation between application development and data protection enforcement. Restricted users receive tokenized values for protected fields, while privileged users pass the same policy check and receive clear text. Because enforcement happens in the network path, deployments should pair DSG with network controls that prevent direct application access to the MongoDB cluster. This helps ensure that sensitive data remains protected consistently through the approved gateway path.
The data journey
Visualizing the data journey
The data journey
The data journey explained
- 01
Route MongoDB connections through DSG
Applications and services use the Data Security Gateway endpoint instead of connecting directly to the MongoDB cluster. DSG receives supported requests from approved drivers and application access paths.
- 02
Authenticate the caller and evaluate policy
The gateway validates the requesting identity and determines which protection rules apply to the collection, document, and selected fields.
- 03
Protect sensitive fields before storage
For write operations, DSG tokenizes, masks, or encrypts the fields identified by policy before forwarding the document to MongoDB.
- 04
Return policy-governed values after access
For read operations, DSG determines whether each protected field should be returned as clear text, a masked value, or a token before sending the response to the requesting application or user.
DEPLOYMENT
The Protegrity Data Security Gateway is deployed independently as a cluster between MongoDB clients and the database environment. Applications route approved MongoDB traffic through DSG, where centrally managed rules determine how selected document fields are protected or returned.
Deploy the DSG Cluster
Connect Protegrity Policy Management
Route MongoDB Connections Through DSG
Restrict Direct Cluster Access
Configure Caller Authentication and Access
Validate Protect and Unprotect Behavior
RESOURCES
Guidance for implementing and managing gateway-based data protection for MongoDB environments.
Protegrity Data Security Gateway Documentation
Review technical guidance for deploying DSG, configuring gateway rulesets, managing authentication, and applying field-level protection to supported application traffic.
READ MOREProtegrity Policy Administration Documentation
Learn how to configure data elements, access policies, protection methods, and centrally managed rules for Data Security Gateway deployments.
READ MOREData Protection Methods
Explore Protegrity tokenization, masking, and encryption methods for protecting sensitive fields across enterprise data environments.
READ MORE