Short answer: give every logistics upload a new version ID, then derive every WebP and AVIF key from that immutable ID. Keep the objects private and issue expiring download links. This is the least complex design that prevents a thumbnail job from overwriting either the source image or an earlier delivery-proof set.

Choice Access control Overwrite safety Operational load Best fit

Immutable keys plus signed downloads Private by default Strong if writers never reuse a version Low Normal SaaS uploads

Mutable keys plus database locking Private by default Depends on lock discipline Medium Editors that must replace in place

Versioned or locked storage Product-specific Designed for recovery or retention Higher Regulated archives

For a one-person logistics SaaS, I would start with the first row. It keeps authorization in the application and turns publishing into a database pointer change.…