Short answer: keep each tenant's PDF and DOCX backup snapshots in a private object-storage bucket, make the snapshot key immutable, and let the Node.js service authorize a restore before it mints a short-lived signed download URL. Put ownership and restore state in a database; bucket metadata is useful context, not an authorization system.

That decision follows the awkward constraint in logistics: a document may need to be delivered quickly during a shipment dispute, while access must remain scoped to the tenant that owns it. Delivery simplicity is valuable, but it must come after the ownership check. A permanent link reverses that order.

The constraint is tenant isolation, not file upload

Start with a record that has a tenant ID, a document ID, a snapshot ID, an object key, the original filename, the media type, and a lifecycle state such as writing , ready , or deleted . The object store holds bytes.…