Document Archive System - Revision-Safe Document Management

WORM Archive with Commercial PDFs, Soft Delete and Legal Hold

2025-2026 Customer Project

Project Description

This project implements a secure, revision-safe document archive system similar to DocuWare or Kendox. The system ensures document integrity through SHA-256 hashing, immutable versioning, and comprehensive audit logging. Key features include WORM storage, AES-256-CBC encryption at rest, legal hold, soft-delete with ghost restore, configurable retention policies, role-based access control, and WORM-style archiving of commercial PDFs (offers, contracts, invoices) on print and lock.

Key Features

WORM Storage

Write Once Read Many principle prevents document modification after archiving

AES-256 Encryption

At-rest encryption for all stored archive files using Laravel encryption

Immutable Versioning

Every change creates a new version, original versions are never overwritten

Comprehensive Audit Logging

All actions including views, downloads, and access changes are logged with IP and user agent

Retention Policies

Configurable retention periods with automatic WORM lock and deletion rules

Document-Level Access Control

Role-based access with view, download, and full permissions per document

Commercial PDF Archive

Lock and archive offer, contract, invoice and dunning PDFs with WORM semantics

Soft Delete & Legal Hold

Ghost restore for soft-deleted records and legal hold to block erase

Technology Stack

Backend Framework

Laravel 11
PHP 8.2+
MySQL

Security

SHA-256 Hashing
AES-256-CBC
WORM Compliance

Frontend

Livewire
Alpine.js
Bootstrap

Storage

Local Filesystem
S3/MinIO
UUID Filenames

Workflow

  1. Document Upload: User uploads document with metadata and index fields
  2. Hash Calculation: SHA-256 hash is calculated for integrity verification
  3. Encryption: Document is encrypted with AES-256-CBC before storage
  4. UUID Storage: File is stored with UUID filename in year/month directory structure
  5. Version Creation: Initial version record is created with hash and metadata
  6. Archive Number: Unique archive number is generated (e.g., ARC-2026-000001)
  7. Audit Logging: All actions are logged including IP address and user agent
  8. Access Control: Role-based permissions control who can view, download, or manage
  9. Integrity Verification: Hash verification ensures document integrity over time
  10. Legal Hold: Documents can be placed on legal hold to prevent any deletion
  11. Commercial Archive: Offers, contracts and invoices are WORM-archived on print or lock
  12. Soft Delete: Soft-deleted records can be restored from ghost state when not on hold