Tamper-evident audit trails and compliance tooling for Laravel.
Documentation · Live Demo · Discussions · Issues
Most audit logs are just a table you write to. Anyone with database access can edit a row, drop a record, or backdate an entry - and nothing about the log itself would reveal it. Chronicle exists to close that gap.
Chronicle is an append-only, hash-chained ledger for Laravel. Every entry is cryptographically linked to the one before it, so tampering with history is detectable rather than silent. Around that core, we maintain packages for permissions, data-subject rights, and admin tooling - the pieces you actually need when an auditor asks how you know your records are intact.
Built for teams working under SOC 2, HIPAA, and GDPR.
| Package | Description |
|---|---|
| chronicle | The core ledger. Append-only writes, hash chaining, action registry, write policies, checkpoints, key rotation, and crypto-shredding. |
| filament | A read-only Filament panel for browsing, verifying, and exporting the ledger - plus audited GDPR erasure. |
| anchor-s3 | Anchors ledger checkpoints to S3 Object Lock, so proof of history lives outside your application entirely. |
| kms-aws | AWS KMS custody for key-encryption keys, for teams that don't want key material on the app server. |
demo.laravel-chronicle.dev - MedLedger, a sample patient-records application built on Chronicle. Browse the ledger, run a chain verification, and watch a GDPR erasure request produce an audited proof entry without rewriting a single existing record.
- Append-only, always. Nothing in the ecosystem mutates a written entry. Even GDPR erasure works by destroying key material and writing an audited proof entry, never by rewriting history.
- Verifiable, not just stored. Chain verification, external checkpoint anchoring (RFC 3161 timestamping, S3 Object Lock), and multi-key verification are first-class.
- Boring to adopt. Sensible defaults, no required infrastructure to get started, and an escape hatch at every layer.
- Held to a high bar. Pest test suites and PHPStan level 10 across every package.
composer require laravel-chronicle/core
php artisan chronicle:installFull guides, recipes, and the compliance handbook live at laravel-chronicle.dev.
Issues, discussions, and pull requests are all welcome. If you're not sure where to start, look for good first issue on any repo, or open a thread in Discussions - questions about compliance workflows are just as useful to us as code.
Every package follows the same contribution guide, code of conduct, and security policy, which live in this .github repository.
If you've found a vulnerability, please do not open a public issue. Report it privately through GitHub Security Advisories, and we'll respond as quickly as we can.
Maintained by Vasileios Ntoufoudis and contributors. Released under the MIT License.