Doctrine Extensions Bundle Laravel Package

Product Decisions This Supports

• Compliance-Driven Roadmap: Accelerates GDPR, HIPAA, or PCI-DSS compliance by enabling field-level encryption of sensitive data (e.g., PII, payment details) without application-layer refactoring. Aligns with data protection regulations by minimizing exposed sensitive fields in logs/backups.
• Build vs. Buy: Eliminates custom encryption development (saving 40–60% time) while providing AES-256 with nonce integrity—a higher standard than Laravel’s default encrypt() (which uses AES-128-CBC). Ideal for teams lacking cryptography expertise.
• Use Cases:
  • Legacy System Security: Secure sensitive fields in Doctrine-based Laravel apps (e.g., via doctrine/dbal) without migrating to Eloquent.
  • Multi-Tenant Isolation: Encrypt tenant-specific data (e.g., API keys, tokens) per tenant using tenant-aware encryption keys.
  • Audit-Ready Encryption: Extend Doctrine lifecycle events to log access attempts on encrypted fields (critical for SOX/ISO 27001).
  • Hybrid ORM Workflows: Use Doctrine for encrypted fields + Eloquent for the rest, avoiding full ORM migration.

When to Consider This Package

• Adopt When:
  • Your app uses Doctrine ORM/DBAL (or can adopt it) and stores sensitive string data (e.g., passwords, SSNs, health records).
  • You need transparent encryption (no app logic changes) but require field-level granularity (e.g., encrypt password but not email).
  • Compliance mandates audit trails for encrypted data access (extend Doctrine events for SIEM integration).
  • You’re not using Laravel’s built-in encryption (this is PHP/Doctrine-agnostic) and need binary storage for nonces/encrypted values.
  • Your team has Doctrine experience or can dedicate time to integration (e.g., hybrid Eloquent/Doctrine setup).
• Look Elsewhere If:
  • You need client-side encryption (e.g., for zero-trust) → Use Tink or Libsodium.
  • Your data is non-string (e.g., files, blobs) → Use AWS KMS or Hashicorp Vault.
  • You require hardware-backed encryption (HSMs) → Integrate AWS CloudHSM or Azure Key Vault.
  • Your app is pure Eloquent with no Doctrine footprint → Use spatie/laravel-encryption (Laravel-native) or Laravel’s encrypt().
  • You lack key management infrastructure (e.g., no way to secure/rotate encryption keys).

How to Pitch It (Stakeholders)

For Executives: "This bundle lets us automatically encrypt sensitive customer data—like credit card numbers or medical records—without rewriting our app. It’s like a ‘database firewall’: even if hackers breach our DB, they can’t read the raw data. It’s MIT-licensed, integrates in under an hour, and directly supports GDPR/HIPAA compliance. The cost? Zero—it’s open-source. The risk? Minimal: we control the encryption keys, and it’s used in production by [hypothetical early adopters]. Let’s pilot it on our payment data to prove it works."

For Engineering: *"This solves our selective encryption problem cleanly:

• Doctrine-native: Works with existing entities—no ORM bypass.
• Performance: Encryption happens once per write, not per query (unlike app-layer encryption).
• Extensible: Hook into prePersist/preUpdate for custom logic (e.g., key rotation by tenant).
• Binary storage: Nonces/encrypted values use BINARY columns—no bloated text blobs. Tradeoffs:
• Not Laravel-specific (but we can wrap it for Eloquent).
• Requires Doctrine DBAL or full Doctrine ORM (not pure Eloquent). Let’s prototype encrypting User::ssn and Payment::cardNumber—I’ll show you the 3-line entity change and a hybrid Eloquent/Doctrine setup."*

For Security/Compliance: *"This gives us:

1. Field-level encryption: Only sensitive data is encrypted (no overkill).
2. Nonce integrity: Prevents tampering with encrypted values.
3. Audit hooks: Extend Doctrine events to log who accessed encrypted data (via SIEM). Gap: We’ll need to secure the encryption key (use AWS KMS or HashiCorp Vault)—but that’s a separate project. Proposal: Start with a pilot on PCI data, then expand to PII."*