Building a GDPR-Compliant Multi-Tenant CRM with Laravel

Building a CRM that handles personal data (names, emails, phone numbers, addresses) in the EU means you can't treat GDPR as an afterthought. Here's how we implemented it in WB-CRM, our multi-tenant CRM built with Laravel 12. 1. Database-per-Tenant Architecture We use stancl/tenancy v3 with database-per-tenant isolation. Each tenant gets their own MySQL database (tenant_acme, tenant_demo, etc.). // Central models explicitly set their connection protected $connection = 'central'; // Tenant models rely on the bootstrapper — no $connection property // stancl/tenancy switches the default connection automatically Why not shared database with row-level security? In a shared database, one missing WHERE tenant_id = ? clause leaks data across companies. With DB-per-tenant, it's architecturally impossible. 2. Field-Level Encryption for PII Laravel's encrypted cast encrypts individual database fields with AES-256: protected function casts(): array { return [ 'name' => 'encrypted', 'email' =>