Protection with clear boundaries.

Live-file encryption

The custom WiredTiger encryptor uses libsodium 1.0.22 XChaCha20-Poly1305 with a random 256-bit key per store, random 192-bit nonces and authenticated blocks. The full native engine also protects MongoDB temporary spill files and forces encryption during collection/index creation. Process diagnostics use separately derived AES-256-GCM keys.

This native encryption works independently of EFS and BitLocker. Metadata such as filenames, sizes, public database names and key identifiers is visible. Record and index values must be usable in process memory while the database is running.

Connection and keys

• The engine binds to 127.0.0.1 on an automatically selected port.
• Mutual TLS protects the local connection; SCRAM-SHA-256 authenticates it.
• Application code receives a rotating readWrite account for its database.
• Windows DPAPI CurrentUser protects the private vault. There is no embedded vendor/master recovery key.
• Raw data-key material is passed to the engine through a bounded stdin frame, not an argument, environment variable or plaintext key file.

What this does not guarantee

MongoDB 4.0 reached end-of-life. This encryption layer does not supply upstream server maintenance. The custom engine disables its own minidump writer; that does not disable every Windows or Node crash mechanism.

Your application still has a role

Validate inputs, authorize application actions and protect the desktop runtime. For Electron, keep database access in the main process or a suitable local backend and expose a narrow validated IPC API. Do not expose raw database access in an untrusted renderer. Report security concerns to info@bsonlite.com without attaching secrets or private records.