Download the PHP package ginkelsoft/laravel-data-retention without Composer

On this page you can find all versions of the php package ginkelsoft/laravel-data-retention. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of ginkelsoft/laravel-data-retention

Informations about the package laravel-data-retention

Ginkelsoft Laravel Data Retention

Tests Latest Version on Packagist Laravel PHP

Overview

The GDPR — and its Dutch implementation, the AVG — requires that personal data be kept for no longer than is necessary for the purposes for which it is processed (art. 5(1)(e), the storage-limitation principle). Knowing this rule is one thing; proving that it is being applied consistently across an Eloquent codebase is another.

Laravel Data Retention lets you declare a retention policy on every Eloquent model, sweeps expired records on a schedule, and writes a tamper-evident audit log that lets you demonstrate, after the fact, that the data really was retired — when, how, and under which policy.

This is the storage-limitation member of the GinkelSoft compliance family. The other AVG controls (right to be forgotten, subject access, consent, breach registry) live in sibling packages — install the hub to get the whole family in one go. See The family below.

Upgrading from v1.x? The v1.x release of this package bundled five controls in one. v2.x reduces it to storage limitation only; the other four are now separate packages. Hash chains in existing retention_log tables remain byte-identical and continue to verify. See UPGRADE.md in the core repo for the migration steps.

The family

Package GDPR Article(s) Role
laravel-compliance-core art. 5(2) Shared primitives (hash chain, strategies, subject hash)
laravel-data-retention art. 5(1)(e) Storage limitation — this package
laravel-data-right-to-be-forgotten art. 17 Subject-driven erasure
laravel-data-subject-access art. 15 + 20 Read-only subject export
laravel-data-consent art. 6(1)(a) + 7 Consent registry
laravel-data-breach-registry art. 33 + 34 Personal-data breach register
laravel-compliance-hub art. 5(2) Umbrella: installs the whole family, verifies every chain

How it works

1. Declare a policy on the model

Attribute form — best for "just delete after N years":

Property form — required for anonymize, because each field gets its own strategy:

2. Register the models

config/data-retention.php:

Only listed models are touched. Forgetting to list a model is the safe failure mode.

3. Schedule the sweep

Or run it manually:

4. Read the audit log

Every action produces one row in the retention_log table:

model_type model_id action retention_period retention_field expired_at performed_at previous_hash hash
App\Models\Client 01HXYZ... anonymized 5 years ended_at 2020-05-26 00:00:00 2026-05-26 02:00:01 (prev sha256) sha256…

Verify the entire chain at any time, using the shared core HashChain:

If the chain ever fails to verify, somebody touched the log table. That is exactly what auditors want to be able to detect. (Or run php artisan compliance:verify from the hub to verify every chain in the family in one go.)

Security model

Threat Mitigation
Retroactive edit of a log row Every row's hash depends on the previous row's hash + a shared secret. Editing a row invalidates every later row.
Forged log row inserted by an attacker without the log_secret The forged row cannot produce a hash that chains with both its neighbors.
Application code accidentally mutating the log RetentionLogEntry throws on update() / delete(). Bypassing it via raw queries still breaks the chain.
Leaking PII via the log itself Only class + primary key + policy metadata are logged. No field values, ever.
Soft-deleted rows hiding personal data forever retention:run calls forceDelete() on soft-deleted models so the storage-limitation principle is actually satisfied.
Operator confidence before first run --dry-run reports every action that would occur, writes nothing.

The shared compliance.log_secret (with BC fallback to data-retention.log_secret) plays the role of a HMAC key: it lives in .env, not the database, so an attacker with read/write access to the DB cannot forge a consistent chain unless they also exfiltrate the secret.

Compliance notes

This package is not legal advice. Retention periods must be set by your DPO based on your processing purposes.

Installation

Then add a secret to .env:

Existing installations upgrading from v1.x can keep their DATA_RETENTION_LOG_SECRET — core's LogSecret helper reads it as a fallback so existing hash chains keep verifying after the upgrade.

Configuration reference

Option Default Description
models [] Classes processed by retention:run. Anything not listed is never touched.
include_soft_deleted true Whether soft-deleted rows also count for retention. Recommended true (they still hold PII).
chunk_size 500 Records per chunk when iterating large tables.

The signing secret and anonymize placeholders are in the shared compliance config provided by ginkelsoft/laravel-compliance-core.

Anonymize strategies

The three built-in strategies live in laravel-compliance-core and are shared with laravel-data-right-to-be-forgotten:

Strategy id Class Output
'null' Ginkelsoft\ComplianceCore\Strategies\NullStrategy Sets the field to null.
'hash' Ginkelsoft\ComplianceCore\Strategies\HashStrategy SHA-256 of {model}|{field}|{value}|{secret}. Stable across re-runs.
'placeholder' Ginkelsoft\ComplianceCore\Strategies\PlaceholderStrategy The configured placeholder string ([REDACTED] by default).
Closure (resolved inline) function (mixed $value, string $field, Model $model): mixed

Implement Ginkelsoft\ComplianceCore\Contracts\AnonymizeStrategy if you need a reusable custom strategy.

Trying it out (demo seeder)

After the run:

Framework compatibility

Laravel Version Supported PHP Versions
10.x 8.2 – 8.3
11.x 8.2 – 8.4
12.x 8.3 – 8.5
13.x 8.3 – 8.5

Supported databases

Database-agnostic — anything Eloquent supports works. Tested on MySQL, MariaDB, PostgreSQL, SQLite (used in CI), SQL Server.

Gotchas

Testing

Contributing

Pull requests welcome — read CONTRIBUTING.md first.

Security

Found a vulnerability? Do not open a public issue. See SECURITY.md for the private reporting channel.

Changelog

See CHANGELOG.md.

Reporting bugs

Found a bug or unexpected behaviour? We want to hear about it.

Preferred — open a GitHub issue: https://github.com/ginkelsoft-development/laravel-data-retention/issues/new

When opening an issue, please include:

  1. Versions — PHP, Laravel, and the package version (composer show ginkelsoft/laravel-data-retention).
  2. What you did — the artisan command, code snippet, or steps that triggered the bug.
  3. What you expected vs what actually happened — include full error output or a stack trace if there is one.
  4. A minimal reproduction if you can — a failing test or a small code sample beats a long description.

Security-sensitive findings (anything that could expose personal data, break a hash-chain, or bypass an audit log) — please do not open a public issue. E-mail [email protected] directly with "SECURITY" in the subject line and we will respond privately.

Not on GitHub? You can also e-mail [email protected] with the same information.

Contact

For commercial support, integration questions, or anything that doesn't fit a GitHub issue: [email protected] — https://ginkelsoft.com.

License

MIT License — see LICENSE. (c) 2026 Ginkelsoft

All versions of laravel-data-retention with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
illuminate/support Version ^10.0 || ^11.0 || ^12.0 || ^13.0
illuminate/database Version ^10.0 || ^11.0 || ^12.0 || ^13.0
illuminate/console Version ^10.0 || ^11.0 || ^12.0 || ^13.0
nesbot/carbon Version ^2.62 || ^3.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package ginkelsoft/laravel-data-retention contains the following files

Loading the files please wait ...