PHPackages laravelsecurityaudit/laravel-ai-ledger - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. laravelsecurityaudit/laravel-ai-ledger ActiveLibrary[Security](/categories/security) laravelsecurityaudit/laravel-ai-ledger ====================================== A processing ledger for AI traffic. Turns the requests Egress Guard observes into a GDPR Article 30 record of processing and a subprocessor register, recording categories and hashes only, never the data itself. The free collector for the Ledger compliance layer. v0.1.0(1mo ago)00MITPHPPHP ^8.2CI passing Since Jun 28Pushed 1mo agoCompare [ Source](https://github.com/laravelsecurityaudit/laravel-ai-ledger)[ Packagist](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-ledger)[ Docs](https://github.com/laravelsecurityaudit/laravel-ai-ledger)[ RSS](/packages/laravelsecurityaudit-laravel-ai-ledger/feed)WikiDiscussions main Synced 2w ago READMEChangelogDependencies (10)Versions (2)Used By (0) Laravel AI Ledger ================= [](#laravel-ai-ledger) A processing ledger for AI traffic. It turns the requests Egress Guard observes into the AI-subprocessor portion of a GDPR Article 30 record of processing, so you can answer, with evidence, which personal data goes to which AI provider, processed where, under what contract, and for how long. It records categories and hashes only, never the data itself. A record says "an email address and a payment card were sent to OpenAI (EU region), the card redacted before send, under SCCs, 30-day retention". It never stores the email or the card. This is the free collector. The independent witness (tamper-evidence an auditor accepts) and the always-current subprocessor dataset are the hosted Ledger Cloud (paid). > This is an independent open-source package. It is not affiliated with, endorsed by, or sponsored by Laravel, Laravel LLC, or any AI provider. It documents and evidences processing; it does not make your app compliant. Have a DPO or privacy counsel own the legal content and review the output. This is not legal advice. Requirements ------------ [](#requirements) - PHP 8.2+, Laravel 12 or 13 - `laravelsecurityaudit/laravel-ai-egress-guard` (it provides the `AiRequestCaptured` signal) Installation ------------ [](#installation) ``` composer require laravelsecurityaudit/laravel-ai-ledger php artisan migrate ``` It subscribes to Egress Guard automatically. Every captured AI request becomes a category-only processing record. What it records --------------- [](#what-it-records) For each AI call: the subprocessor and its company, the processing region, sub-subprocessors, the purpose (configured per route), the categories of personal data detected, a pseudonymous data-subject reference, the legal basis, whether it is a third-country transfer and the safeguard, which categories were redacted before send, the provider retention, and a local hash chain. The provider facts come from the `SubprocessorRegistry`; the categories come from Egress Guard's findings. Export ------ [](#export) ``` php artisan ai-ledger:export --type=ropa --format=markdown php artisan ai-ledger:export --type=register --format=json --output=subprocessors.json ``` `ropa` is the Article 30 record grouped by subprocessor; `register` is the subprocessor register from the dataset. Configuration ------------- [](#configuration) ``` php artisan vendor:publish --tag=ai-ledger-config ``` Set your `controller_ref`, the default `legal_basis`, per-source `purposes`, the processing `regions` you actually use, the residency `allowed_regions`, the `categories` map, and the `subprocessors` dataset. Verify the dataset against each provider's current terms, or let Ledger Cloud maintain it. Residency --------- [](#residency) Set `residency.allowed_regions` (for example `['EU']`). A request to a provider whose region is not allowed is recorded with `residency_ok = false`. To also block it at runtime, enable Egress Guard's residency enforcement (`egress-guard.residency`), which blocks out-of-region calls at the wire. The paid layer -------------- [](#the-paid-layer) Set `AI_LEDGER_CLOUD_ENDPOINT` and `AI_LEDGER_CLOUD_TOKEN` to enable the hosted witness: each record's hash is counter-signed by a party your app does not control, which is what makes the chain credible to an auditor. Without a token the cloud client is a no-op and everything runs locally. Testing ------- [](#testing) ``` composer test composer analyse ``` The Laravel Security Audit family --------------------------------- [](#the-laravel-security-audit-family) One detection engine, guarding every place data leaves your app. PackageWhat it guards[laravel-secret-scanner](https://packagist.org/packages/laravelsecurityaudit/laravel-secret-scanner)Shared secret and PII detection engine (the core)[laravel-mail-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-mail-guard)Outgoing Laravel mail[laravel-ai-egress-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-egress-guard)Outbound AI provider traffic (OpenAI, Anthropic, Gemini)[laravel-ai-lint](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-lint)Static analysis: leaked AI keys and unsafe AI wiring[laravel-ai-circuit-breaker](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-circuit-breaker)Runaway AI loops and spend**laravel-ai-ledger** (this package)GDPR Article 30 processing ledger for AI trafficLicense ------- [](#license) The MIT License (MIT). See [LICENSE](LICENSE). ### Health Score 34 — LowBetter than 74% of packages Maintenance90 Actively maintained with recent releases Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity36 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 45d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/afa88251494388c616878c63f05e227db8524f18bb98f6b2e51b5788ec4cec25?d=identicon)[laravelsecurityaudit](/maintainers/laravelsecurityaudit) --- Top Contributors [![workaandrey](https://avatars.githubusercontent.com/u/1831403?v=4)](https://github.com/workaandrey "workaandrey (2 commits)") --- Tags laravelaigdprcomplianceprivacyropasubprocessor ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/laravelsecurityaudit-laravel-ai-ledger/health.svg) ``` [![Health](https://phpackages.com/badges/laravelsecurityaudit-laravel-ai-ledger/health.svg)](https://phpackages.com/packages/laravelsecurityaudit-laravel-ai-ledger) ``` ### Alternatives [laravel/ai The official AI SDK for Laravel. 1.1k4.6M305](/packages/laravel-ai)[psalm/plugin-laravel Psalm plugin for Laravel 3345.4M354](/packages/psalm-plugin-laravel)[laravel/cashier Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services. 2.6k31.8M158](/packages/laravel-cashier)[illuminate/queue The Illuminate Queue package. 20433.0M1.8k](/packages/illuminate-queue)[spatie/laravel-health Monitor the health of a Laravel application 88212.7M185](/packages/spatie-laravel-health)[api-platform/laravel API Platform support for Laravel 58190.1k21](/packages/api-platform-laravel) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)