Short answer: for an edtech product serving generated reports to authenticated customers, use a private object-storage bucket, upload unusually large image files in numbered parts, and make retention and deletion state part of the application record. A complete upload is not permission to keep an object forever. The least complex option is still a single upload for an image that is small and predictable enough to fit the service's normal request limits. Multipart upload earns its complexity w...