What is file upload and storage?

File upload and storage lets users attach files to records in your app — profile photos, identity documents, invoices, images, signed forms, or any other file your business process requires. The files are stored in cloud object storage rather than on your server's disk, making them scalable, durable, and accessible from anywhere.

For most apps, this means AWS S3 or Cloudflare R2. The upload experience ranges from a simple file picker to a drag-and-drop zone with progress indicators. Files are stored at a unique URL and retrieved on demand — the app never serves the files directly, it just holds a reference to where they live.

File uploads feel simple from a user perspective but involve a handful of important decisions around security, performance, and privacy that are worth getting right from the start.

When does your app need it?

• Users need to attach supporting documents to records — ID verification, contracts, receipts, photos
• Your app manages images — product photos, profile pictures, before/after comparisons
• Staff need to upload files as part of a workflow — inspection photos, signed forms, certificates
• You're replacing a system where files are currently emailed back and forth or stored in Google Drive
• Your app handles client onboarding that requires document collection (licences, insurance certificates)
• Users generate or receive documents (from the app's PDF generator, for example) that need to be stored and retrievable later

How much does it cost?

Adding file upload and storage typically adds 3–5 hours of development — roughly from $1,000 AUD at Australian boutique agency rates.

A basic implementation (single file upload, stored in S3, accessible via a secure URL) sits at the lower end. Adding multiple file uploads, file type and size validation, image resising and optimisation, progress indicators, virus scanning, and CDN delivery sits at the higher end. The ongoing infrastructure cost for S3 or R2 storage is typically small — under $10/month for most SME apps.

How it's typically built

The standard pattern for web apps is presigned URL upload: rather than sending the file through your server (which wastes bandwidth and server resources), the backend generates a short-lived presigned URL that allows the browser to upload directly to S3. The server receives only the final file reference (key, size, type), not the file itself.

File type validation happens in two places: client-side (checking the file extension and MIME type before upload) and server-side (verifying the actual file signature, not just the extension). Size limits are enforced at the S3 bucket level and validated before generating the presigned URL.

For images, Sharp is the standard Node.js library for resising and optimising uploads — generating appropriately sized variants rather than storing a 12MB phone photo when a 200KB web-optimised version is sufficient.

Virus scanning can be added via ClamAV (self-hosted, zero cost per scan) or a cloud service (Cloudmersive, VirusTotal API). This is worth including for any app that accepts files from untrusted users.

Access control is critical: files are stored with private permissions, and users access them via short-lived presigned download URLs generated by your API — not via a permanent public link. This ensures users can only retrieve files they're authorised to see.

Questions to ask your developer

• Who is allowed to see which files? Define access control rules upfront — can any user see any file, or are files scoped to the uploading user or their organisation?
• Do we need virus scanning? For apps that accept files from unknown users (customer uploads, job applications), virus scanning is strongly recommended.
• Should images be resised or optimised on upload? Storing originals is simple; generating multiple variants (thumbnail, web, original) is more work but important for performance.
• What file types and sizes should we accept? Define an allowlist of accepted MIME types rather than blocking known bad types — this is more secure.
• Do we need to store files in Australia? If files contain personal data, using an Australian AWS region (ap-southeast-2, Sydney) helps with Privacy Act compliance.

---

See also: Document management · PDF report generation · App cost calculator