Serving a generated report is easy until a customer asks for an old PDF, an updated DOCX, or proof that a deleted document is really gone. For a B2B SaaS product, the least complex design is a private bucket with server-side uploads and short-lived signed download URLs. Public links are a poor fit for customer data.

Short answer: keep objects private, put ownership and retention state in your database, and mint a signed URL only after your application authorizes the download. Use a provider with S3-compatible semantics when portability matters; choose a broader platform when you need replication, object lock, or browser-upload controls that the smaller option does not provide.

What actually drives the retention bill?

The storage object is only one line item. The dominant operational cost is usually the bytes you keep for every generated report, plus the copies created when a user replaces a file.…