MongoDB Atlas Setup Runbook

Status: Phase 1 in progress. Last updated April 12, 2026. Purpose: SOC 2 evidence for CC7.1 (Infrastructure Management), CC8.1 (Change Management)

---

Cluster Details

Field	Value
Atlas Organization	AskFlorence
Atlas Project	AskFlorence
Cluster Name	askflorence-prod-01
Tier	M10 (HIPAA-eligible)
Cloud Provider	AWS
Region	us-east-1
MongoDB Version	7.x (latest stable)
Created Date	April 12, 2026
Created By	Taha Abbasi (Founder)

Compliance Configuration

Setting	Status	Notes
BAA (HIPAA)	Pending signature	Available in Atlas Organization → Compliance
Encryption at Rest	Enabled	AES-256, Atlas default on M10+
Encryption in Transit	Required	TLS for all connections, Atlas default
Atlas Audit Logging	Pending enablement	Captures auth events, CRUD operations
Continuous Backup	Enabled	Atlas default on M10+, verify ≥7 day retention
Network Access	IP allowlist	Development IPs only; VPC peering deferred until ECS deployment

Database

Field	Value
Database Name	askflorence
Created	April 12, 2026

Phase 1 Collections

Collection	Purpose	Created
plan_years	State+year configuration (FPL, SLCSP, contribution brackets, Essential Plan tiers, tier multipliers, standard cost-sharing)	April 12, 2026
plans	Full plan data: premiums by region, ~54 benefit/copay fields, deductible, MOOP, issuer, metal, URLs, counties served	April 12, 2026
regions	Rating regions with county lists, SLCSP, lowest Silver premium, plan count	April 12, 2026
zip_county	Zip code → county name, FIPS code, state, region lookup	April 12, 2026
audit_log	API access events, data ingestion actions, PHI access trail	April 12, 2026

Cross-cluster reference reads (Phase 11 — live 2026-05-08)

The doctor + Rx coverage flow on prod (askflorence.health) reads non-PHI public CMS marketplace reference data from the staging Atlas cluster over AWS PrivateLink. This avoids duplicating 2.14M provider docs + 12,557 RxCUI / ~30M drug-plan tuples onto the prod cluster (which would have forced an M10 → M30 tier upgrade at +$326/mo).

Field	Value
Source cluster	askflorence-staging (project_id 69e31af12fd2c0aef51bbb41, M30)
Source collections	formularies_staging (12,557 RxCUIs / ~30M tuples), providers_staging (2.14M NPIs)
Connection path	Prod VPC → AWS Interface VPC Endpoint vpce-0c81aea11e29bb928 → Atlas endpoint service com.amazonaws.vpce.us-east-1.vpce-svc-0d8138ea0f6542afa → staging cluster
Atlas user	app_read_staging (read-only role on askflorence database)
Connection string	mongodb+srv://askflorence-staging-pl-0.… — populated in AWS Secrets Manager prod/mongodb/reference-uri (project CMK encrypted)
Application contract	getReferenceDb() in src/lib/db.ts — distinct connection pool from getDb(). Routes via MONGODB_REFERENCE_URI; falls back to MONGODB_URI when unset (dev + staging unaffected by code path)
Network posture	AWS-backbone-only (no public internet path); identity-bound at AWS account level; TLS 1.2+ at app layer (doubly-protected encryption per HIPAA §164.312(e)(1))

Decision record: ADR 0004 — Cross-cluster Atlas reads from prod via AWS PrivateLink. Cost analysis + path comparison: #101.

Operational notes:

• The ingest pipeline that writes formularies_staging + providers_staging runs in the staging AWS account (549136075525), not prod. Prod app picks up refreshes automatically via PrivateLink — no prod-side cron, no double-ingest, no cluster cutover needed.
• Refresh cadence + delta-aware ingest design tracked in #98.
• Drift guard: #100 (CI guard) protects against PHI-class data ever landing on the staging cluster — that would silently break the "non-PHI cross-cluster read" architectural claim.

Phase D follow-on (#96): the provider-network fallback (lookupStagingProviderNetwork()) mirrors today's drug-tier-fallback (lookupStagingDrugTiers()) using the same getReferenceDb() helper. Cross-cluster path is already wired; just needs the analogous lookup function + route handler.

Indexes

plan_years

{ state: 1, year: 1 }         — unique

plans

{ state: 1, year: 1, program: 1 }
{ countiesServed: 1 }
{ hiosId: 1, year: 1 }        — unique
{ state: 1, year: 1, metal: 1 }

regions

{ state: 1, year: 1, regionId: 1 }  — unique

zip_county

{ zip: 1 }                    — unique

audit_log

{ timestamp: -1 }             — query ordering
{ timestamp: 1 }              — TTL: 7 years (220,752,000 seconds)

Database Users

Bootstrap User (created during setup)

User	Role	Purpose
atlas-admin-taha	Atlas admin	Initial setup and administration

Scoped Service Users (deferred — to be created after collections exist)

User	Access	Purpose
app-read	Read-only on plan_years, plans, regions, zip_county	API server queries
app-write	Read-write on all Phase 1 collections	Data ingestion scripts
audit-write	Insert-only on audit_log	API audit trail writes

Status: Scoped users are intentionally deferred until Phase 1 collections are created and verified. This ensures permissions are scoped against real database resources, not overly broad bootstrap grants.

Connection String Format

mongodb+srv://<user>:<password>@askflorence-prod-01.njkihm.mongodb.net/askflorence?retryWrites=true&w=majority

Credentials are stored in:

• Development: .env.local (gitignored)
• Production: AWS Secrets Manager (future)

Never committed to source control. See .env.example for placeholder format.

Backup Configuration

Setting	Value
Backup type	Continuous (Atlas managed)
Retention	Minimum 7 days
Point-in-time recovery	Available within retention window
Backup encryption	Same as cluster encryption (AES-256)

Network Access

Entry	IP/CIDR	Purpose	Added	Remove By
Development (open)	0.0.0.0/0	Development phase — open access	April 12, 2026	Before production launch

Future: VPC peering with AWS ECS when the API service is deployed. At that point, development IPs will be removed and all access will flow through the VPC peer.

Setup Script

Database and collection creation is automated via:

node scripts/db/setup-collections.js

This script:

• Connects using MONGODB_URI from .env.local
• Creates the askflorence database
• Creates all 5 Phase 1 collections
• Creates all indexes (idempotent — safe to re-run)
• Prints verification summary

Next Steps

• [ ] Sign Atlas BAA
• [ ] Enable Atlas audit logging
• [ ] Create scoped service users after collections are verified
• [ ] Verify backup retention is ≥7 days
• [ ] Load NY 2026 plan data (Issue #45)
• [ ] Set up VPC peering when ECS is deployed