Short answer: for browser direct-to-storage upload from a Node.js SaaS frontend, use a short-lived presigned URL, keep every product image and tenant export private, and make your database own the retention and deletion state; choose the S3-compatible provider only after CORS, recovery, residency, and cleanup tests pass.

The cheapest option isn't the one with the smallest storage-rate cell. Browser egress, abandoned multipart uploads, operational labor, and a deletion design that quietly retains customer data can reverse that ranking. I wouldn't approve an architecture from a price table alone — especially for US and EU tenants whose retention promises may differ.

Four rules carry most of the load: the backend chooses the tenant-scoped key; the browser receives only an expiring operation-specific URL; deletion is a recorded workflow rather than an untracked button click; and exports have an explicit expiry plus a verified purge.…