Workflows
Export masked MongoDB data
Stream canonical NDJSON while pseudonymizing, redacting, or excluding sensitive fields without modifying the source collection.
Privacy Export transforms only the streamed copy. Source documents are never updated. Use it when a query result needs to leave the production environment without carrying the original identifiers and sensitive fields with it.
Build masking rules
- Run the intended find or read-only aggregation in Browse or Optimize.
- Choose Privacy export.
- Add one to 50 dotted field paths, such as
customer.email. - Select a transform for each path.
- Preview the first visible document.
- Choose Export masked NDJSON and select a native destination.
The three transforms have different jobs:
| Transform | Result |
|---|---|
| Pseudonymize | Replaces a value with a type-compatible deterministic value for this export. Equal inputs remain joinable within the file. |
| Redact | Replaces a value with a type-compatible constant. Equality is deliberately lost. |
| Exclude | Removes the field from each exported document. |
Every export receives a new random secret key. Pseudonyms are stable within one file and different across separate exports. The key is never persisted.
The export preserves BSON meaning
Output is newline-delimited canonical Extended JSON. Common BSON categories remain represented as their own types instead of being flattened into ambiguous strings or JavaScript numbers.
The exporter streams in batches and writes through an atomic temporary file. A large result is not materialized in renderer memory. Canceling closes the cursor and removes the incomplete temporary output. Progress reports documents and bytes written.
Rules are local and bounded
Field suggestions come from the first already-visible document. Preview and every masking transform run in the privileged local engine. Rules reject empty, duplicate, unsafe, and excessive paths.
Masking happens after MongoDB returns each matching document and before the document is written to disk. It does not alter the query, projection, sort, collation, hint, or aggregation pipeline that defined the export population.
Privacy Export is for analytical and development copies, not database backup. Validate the file against the receiving system's policy before sharing it. A field that is not covered by a rule remains unchanged.
See MongoDB export with masking for format and policy guidance.