Every app that touches personal data eventually hits the same wall. You've got a national_id column, an email, a phone number, maybe a credit card. Compliance (PDPA here in Malaysia, GDPR, SOC 2 — pick your acronym) says you can't just store them in plaintext, and you definitely can't dump them into your audit log when someone edits a record.
The usual answer is "use the framework's encryption." And that works — until you're in a queue worker, a standalone CLI importer, a Symfony service, or a plain PHP webhook handler that doesn't have the framework's container booted. Suddenly your PII handling is coupled to config(), env(), and a service provider that isn't there.
I kept hitting this across different codebases, so I extracted the primitives into a small library: .
If you've got a PII shape that isn't covered yet, the strategy contract is one method — PRs welcome.
SOCIAL SHARE CARD GENERATOR