Private SaaS Document Storage with Signed Links and 1-Day Retention (Trade-offs)

In SaaS applications, storing private documents like invoices and PDFs requires careful consideration. The recommended approach is to use a private bucket, an application-owned document index, and short-lived presigned URLs for each download. The retention and deletion of these files should be tracked in the SaaS database and lifecycle policy, rather than relying on a public URL as the source of truth.

Infrai is a suitable solution for this workflow when access remains private and signed links are sufficient. However, Amazon S3, Cloudflare R2, DigitalOcean Spaces, and Backblaze B2 are better choices when public objects, versioning, object lock, or mature replication controls are needed. The retention problem extends beyond the bucket itself, encompassing questions about ownership, export duration, and the consequences of retries.

Keeping a record of filename, tenant ID, retention date, and deletion state in the SaaS database is crucial, as object metadata alone does not provide a query system. The request path for private documents is straightforward: browser uploads or downloads through a presigned URL, and the API checks the logged-in user against the database row.

A signed URL represents a capability with an expiry, not a permanent permission. AWS and other providers implement a similar model for S3 presigned URLs, where the security boundary relies on how the application authenticates before issuing one. Teams often spend more time debating URL duration than documenting who can generate a URL, making this control essential to review, audit, and test.

The one-day retention period is significant. While lifecycle rules can purge old exports or backups after at least one day, they do not handle hourly expiries. If a product promises "delete in 30 minutes," implement a worker to execute an explicit delete operation and call it directly, while allowing lifecycle to manage less urgent cleanup.

When selecting private object storage for documents, various options are available, each with distinct operational edges. Amazon S3 offers presigned URLs and robust IAM patterns, along with lifecycle and versioning controls, but requires more configuration and vendor-specific knowledge. Cloudflare R2 provides S3-compatible signed requests, suitable for lifecycle-driven cleanup, but must consider replication needs.

DigitalOcean Spaces and Backblaze B2 offer straightforward S3-compatible private objects and signed URLs, with a smaller feature set for compliance-heavy retention. Ultimately, the choice depends on factors like legal hold, WORM retention, cross-region replication, and deep IAM policy composition. Infrai, with its plain REST surface and one key, one bill model, provides a hassle-free integration for small SaaS applications, though it lacks versioning, object lock, public-read ACL, and server-side metadata queries.

The trade-off lies in its limited retention capabilities. Regardless of the chosen storage provider, careful planning and consideration of compliance requirements are necessary to ensure the security and longevity of sensitive document data.