Doctrine Encryption Bundle Laravel Package

Product Decisions This Supports

• GDPR/Compliance Roadmap: Accelerates implementation of data encryption for PII (Personally Identifiable Information) to meet regulatory requirements (e.g., GDPR, CCPA) without custom development.
• Build vs. Buy: Eliminates the need to build a custom encryption layer for Doctrine entities, reducing technical debt and maintenance overhead.
• Security-First Features: Enables encryption at the database layer for sensitive fields (e.g., passwords, medical records, financial data) while preserving usability in controllers, Twig templates, and APIs.
• Legacy System Modernization: Ideal for retrofitting encryption into existing Symfony/Laravel applications using Doctrine ORM without major refactoring.
• Multi-Tenant Isolation: Supports encrypting tenant-specific data in shared databases (e.g., SaaS platforms) via configurable keys per environment/tenant.

When to Consider This Package

• Look Elsewhere If:

  • Active Maintenance Needed: Last release in 2018; evaluate risk of unpatched vulnerabilities or PHP 8+ compatibility issues.
  • Advanced Key Management: Requires dynamic key rotation, hardware-backed keys (HSM), or cloud KMS (AWS KMS, Azure Key Vault) integration—this package lacks built-in support.
  • Performance-Critical Workloads: Encryption/decryption overhead may impact high-throughput systems (benchmark before adoption).
  • Non-Doctrine ORM: Using Eloquent (Laravel) or other ORMs; consider Laravel’s built-in encryption or packages like spatie/laravel-encryption.
  • Schema Flexibility: Need field-level encryption without annotations (e.g., dynamic encryption based on runtime logic).
  • Audit/Logging Requirements: Missing native support for encryption event logging or key access auditing.
  • Modern PHP Features: Lacks support for attributes (PHP 8+) or dependency injection best practices (e.g., no EncryptionService interface).

• Adopt If:

  • Using Symfony/Laravel with Doctrine ORM and need a lightweight, annotation-driven solution.
  • Prioritizing compliance over customization (GDPR/CCPA checkbox item).
  • Willing to fork/maintain for long-term use (low stars/release activity).

How to Pitch It (Stakeholders)

For Executives:

"This package lets us encrypt sensitive customer data (e.g., addresses, payment details) at the database level with minimal code changes—critical for GDPR compliance and reducing breach risks. It’s a ‘buy vs. build’ decision that saves 3–6 months of dev time while adding a security layer to our existing Symfony/Laravel stack. The trade-off is limited maintenance (last updated in 2018), but we can mitigate this by treating it as a short-term solution or forking it for long-term use."

Key Outcomes:

• ✅ Compliance: Checkbox for GDPR/CCPA data protection.
• ✅ Cost Savings: Avoids custom encryption development (~$50K+).
• ⚠️ Risk: Deprecated but functional; propose a 3-month pilot with security audit.

For Engineering:

*"This bundle integrates Doctrine encryption via annotations (e.g., @Encrypted) and a simple service, handling auto-encryption on prePersist/preUpdate. It’s a drop-in for Symfony/Laravel apps using Doctrine, but has gaps:

• No PHP 8+ support (attributes instead of annotations).
• No key rotation (static config).
• Performance: Adds ~10–20ms per encrypted field (benchmark critical paths).

Recommendation:

• Use for non-critical PII (e.g., user profiles) where compliance > performance.
• Avoid for:
  • High-frequency data (e.g., logs, session tokens).
  • Systems needing dynamic keys (e.g., multi-tenant SaaS).
• Mitigations:
  • Wrap in a feature flag for gradual rollout.
  • Pair with a custom EncryptionService interface for future-proofing.
  • Add unit tests for edge cases (e.g., empty strings, large fields).

Alternatives:

• Laravel: spatie/laravel-encryption (more modern).
• Custom: Use defuse/php-encryption + Doctrine listeners if flexibility is critical."*