Data
Object storage
Buckets for files: R2, Amazon S3 and Cloudflare Images, holding uploads, media and raw inbound data across most of our builds.
Object storage is a bucket you put bytes into under a key and read back by that key. No queries, no joins, no partial writes. It is cheap per gigabyte, it scales without you thinking about it, and it is the right home for anything that is a file rather than a row. R2 is Cloudflare's version with an S3-compatible API and no charge for data leaving it, which is the reason we use it in preference to S3 on most builds.
How we use it
DMARC Engine shows the pattern we like best. An aggregate report arrives by email, the worker unzips it and parses the XML, the parsed rows go into the database, and the original file is written to R2 untouched. When the parser turns out to be wrong about some sender's dialect, and it will be, the fix is a re-run rather than an apology.
Objectify exposes storage as a product feature: direct and presigned uploads, signed URLs, file variants, folders, versions, batch operations and a scheduled job that clears up uploads that were begun and abandoned. ClassProfile has the API issue an upload URL for its media bucket with a 50 MB cap so the file never passes through the Worker at all. @Heartbeat sends images to Cloudflare Images for automatic variants and falls back to R2 when the Images binding is absent, one of several decisions weighed in which parts of a social timeline actually cost money. Jonosakti uploads to R2 behind an image optimisation endpoint, Consonas reaches R2 through Laravel's S3 driver, and AHZ Associates serves its site imagery from an S3 bucket.
What it costs you
The bucket knows nothing about your application. Every object needs a row somewhere recording who owns it and whether it is still wanted, and the two sets drift: orphaned rows pointing at deleted objects, orphaned objects nobody can reach. Either way you are writing a reconciliation job, so write it early while the bucket is small.
Operations bill even when transfer does not. R2 charges for writes and lists in one class and reads in another, so a page that lists a prefix on every load is the invoice nobody predicted. Multipart uploads that were started and never completed keep billing for storage until a lifecycle rule removes them, which is exactly why Objectify has a cleanup job.
Presigned URLs need an expiry you have actually thought about. Too short and mobile uploads fail on bad connections; too long and you have handed out a link that outlives the permission that created it.
Cloudflare Images bills per image stored and per delivery, a completely different shape from R2's per gigabyte, so past a certain volume the fallback path is the cheaper one and the decision is per project rather than a default.
Moving providers is easy for the bytes and hard for the addresses. Copying objects is a script; every URL already published, indexed and embedded in old emails is the part that hurts, and the discipline is the same as in rebuild the site, keep the URLs.
When we would choose something else
Small values read on every request are cheaper and faster in key-value storage than as objects. Assets that ship with the site, such as fonts, icons and build output, belong with the hosting and delivery layer rather than in a bucket you have to sign requests against. And anything you need to search or filter by attribute needs its metadata in a real database, with the bucket holding only the bytes.
Where we have used it
Every build below lists this in its stack, so the claim is checkable.
- ObjectifyA hosted backend that gives developers a typed database, authentication, file storage and AI inference behind one REST API.
- DMARC EngineEmail authentication for companies that need DMARC enforced on their domain without blocking their own mail.
- ConsonasA CRM for organisations of roughly two to two hundred people who want customer tracking without an administrator to run it.
- ClassProfileA professional network scoped to a single organisation, for bodies that want a directory of their people rather than a page on somebody else's platform.
- atHeartbeatA free public microblogging site with feeds, media, polls and threaded comments, open to anyone and carrying no advertising.
- JonosaktiA free, MIT licensed site where organisers run petitions, unions, boycotts, mutual aid networks and campaigns from one account.
- AHZ AssociatesA marketing site and a separate student application portal for an education consultancy that places international students at UK universities.
