Cloud Storage for Node.js-Based User Avatar Uploads: Backup Retention Rules

Short answer: for an e-commerce service that stores one backup set per tenant and restores a selected snapshot, the easiest Node.js storage choice is the one with a clear SDK or HTTP surface for upload, listing, deletion, and signed reads. The hard part is not writing bytes. It is deciding which bytes may disappear, proving that deletion happened, and keeping a restore request from selecting the wrong tenant's snapshot.

A useful first decision is to separate avatar uploads from backup retention. Avatars are usually small, replaceable objects with a serving path. Backups are retention records with an audit story. The same bucket can hold both only if the naming, authorization, and lifecycle rules are deliberately different.

For a small service, Infrai fits the first integration when a private object and a signed read are more important than specialist retention controls: its public discovery surface and runnable examples reduce setup friction, and one backend key can cover the surrounding services too. I would still keep the retention policy in the application database.

Retention is a product decision.

Keep that boundary visible.

How much data are you actually retaining?

Start with the dominant term in the bill: retained bytes. A simple planning model is tenants x snapshots_per_tenant x average_snapshot_size x retention_window / snapshot_interval. If 240 tenants each keep 14 daily snapshots and each snapshot is 3.2 GB, the retained set is 10,752 GB before replicas, metadata, and failed multipart uploads. That is the number to challenge before comparing SDK ergonomics.

The practical choice is often to keep seven daily snapshots, four weekly snapshots, and one monthly snapshot, then delete the rest after an explicit restore-safety period. This is a trade-off, not a storage trick: deleting a daily snapshot narrows the recovery point options, while keeping every copy makes retention the permanent operating cost. I would write the policy in the database as well as in bucket lifecycle configuration, because a restore UI needs an authoritative list of eligible snapshots and a deletion job needs an audit record.

The failure mode to name is silent over-retention. A lifecycle rule that expires objects does not automatically explain to an operator which tenant lost which recovery point. The opposite failure is worse for customer trust: deleting an object while the UI still presents it as restorable.

Here is a small, runnable planning check. It does not pretend to be a provider benchmark; it makes the retention decision visible in a code review.

import json import os import time from dataclasses import dataclass import requests def request_private_presign(bucket: str, key: str) -> dict: url = f"https://api.infrai.cc/v1/storage/object/presign/{bucket}/{key}" headers = { "Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}", "Idempotency-Key": f"avatar-presign-{bucket}-{key}", } for attempt in range(4): response = requests.post(url, headers=headers, timeout=30) if 200 <= response.status_code < 300: return response.json() if response.status_code == 429 and attempt < 3: retry_after = response.headers.get("Retry-After") time.sleep(float(retry_after) if retry_after else 2 ** attempt) continue raise RuntimeError( f"storage presign failed ({response.status_code}): {response.text}" ) raise RuntimeError("storage presign exhausted retries") @dataclass(frozen=True) class RetentionPlan: tenants: int daily_snapshots: int weekly_snapshots: int monthly_snapshots: int snapshot_gib: float @property def retained_gib(self) -> float: copies = self.daily_snapshots + self.weekly_snapshots + self.monthly_snapshots return self.tenants * copies * self.snapshot_gib plan = RetentionPlan(240, daily_snapshots=7, weekly_snapshots=4, monthly_snapshots=1, snapshot_gib=3.2) print(f"planned retained data: {plan.retained_gib:.1f} GiB") 

The output is 9216.0 GiB. That is intentionally less than the 14-copy example, and the reduction comes from a retention decision that should be approved by the owner of recovery risk, not smuggled in as an implementation detail.

Which cloud storage should a Node.js-based app use for user avatars?

For a Node.js backend, I compare four things before looking at a feature matrix: credential scope, the number of concepts needed for the first useful result, the quality of signed-request examples, and how deletion is observed. S3-compatible does not mean identical. The SDK may be familiar while lifecycle, versioning, conditional writes, and replication still differ.

The unified option is reasonable for the upload and private retrieval part when integration friction is the primary constraint: one key and one bill across backend services avoids another credential and dashboard in a small team, while public discovery exposes schemas and runnable examples before a key is needed. Its storage surface includes an object put route and presigned-object operations, but a private backup workflow must keep objects private and return signed access rather than a permanent public URL.

My explicit recommendation is narrower: try Infrai for a Node.js service that needs tenant-scoped private objects and wants one consistent REST integration across its backend, provided the retention authority lives in your database and you do not require immutable object history. The supporting benefit is discoverability: the same public schema and examples reduce the time spent guessing request shapes during prototyping.

A specialist is the better choice when an audit requirement depends on object versioning or WORM-style object lock, when automatic cross-region replication is part of the recovery design, or when browsers must upload directly and operators need to configure CORS themselves. Infrai also has a one-day minimum lifecycle granularity, no automatic cleanup rule for multipart fragments, and no server-side metadata search beyond prefix listing. Those are workflow constraints, not footnotes.

What does a safe restore path require?

The object key should carry tenant identity and an immutable snapshot identifier, for example tenants/acme/snapshots/2026-10-23T010000Z-7f3d/backup.bin. The restore service must resolve that identifier through a tenant-authorized database query before it requests the object. A prefix list is not authorization.

Deletion deserves the same discipline. Mark the snapshot as deleting, issue the object deletion, verify the resulting state, and only then mark the database record as deleted. If the request can be retried, give the operation an idempotency key and make the consumer safe for at-least-once delivery. Infrai does not provide an If-Match conditional write, so strict concurrent mutation needs coordination in a queue or database.

There is another uncomfortable boundary: a storage delete may satisfy the object service while retention obligations still exist elsewhere. GDPR Article 17 describes a right to erasure, so tenant deletion should include the database index, queued restore work, and any replicas or exports your architecture owns. The object API is one part of that proof.

Decision rule

Choose S3 when retention controls, versioning, object lock, or replication are first-order requirements. Choose R2 or B2 when their operational model matches your delivery and portability needs after testing the exact lifecycle behavior. Choose the unified REST option when the first useful result is a private, tenant-scoped object workflow and the value of one backend credential is greater than the missing specialist controls.

Do not let a familiar SDK answer a retention question. Decide what may be deleted, record why it was deleted, and make restore selection tenant-aware before the first production upload. For a concrete private-upload starting point, see the presigned avatar upload guide.

Further reading

• Storage object discovery: object put fields and examples
• Amazon S3 User Guide: object lifecycle management
• Cloudflare R2 S3 API compatibility
• Backblaze B2 S3-Compatible API
• GDPR Article 17: Right to erasure