Client-side field-level encryption (CSFLE) encrypts selected sensitive document fields in the application before sending them to MongoDB. For example, an application can encrypt a Social Security number while leaving a name and email address unencrypted. MongoDB stores the encrypted field, not its plain-text value. section 20.5.4
{
"name": " Name Surname",
"socialSecurityNumber": { "$binary": "AE4F0F9DE7..." },
"email": "user@example.com"
}
The stored document shows an encrypted socialSecurityNumber field alongside unencrypted name and email fields. section 20.5.4
An authorized client with the appropriate decryption keys can read or modify the sensitive value. Atlas does not receive its plain text, and database access alone does not reveal it—even to an administrator. The application must therefore retain access to its keys. External key-management options include AWS KMS, Azure Key Vault, GCP KMS, and KMIP-compatible services. section 20.5.4
Use CSFLE as one layer of defense in depth for highly sensitive fields, alongside access controls, auditing, and encryption in transit and at rest. If the application also needs to search encrypted fields, consider Queryable Encryption rather than assuming CSFLE alone provides that capability. section 20.7 section 20.8
