Security infrastructure · Edge
Secure Document Service
Private storage for customers’ KYC documents and photos, opened only by people with a fresh, verified reason.
- Runs on
- Cloudflare’s global edge
- File access
- Checked every time
- OTP channels
- WhatsApp · SMS · email
- Abuse limits
- Token buckets + flood guard
The challenge
Loan files carry sensitive documents: identity, income and property papers. They had to be uploaded from phones, opened by the right people only, and protected from abuse such as OTP flooding.
What we built
We built a file service on Cloudflare Workers and R2. Documents open only after a recent OTP login or for the partner who just uploaded them. Unverified partners see images only as small blurred previews generated on the server, never the original. Every code sent and checked is rate-limited with token buckets, behind a request flood guard.
Inside the product
Key features
Private by default
No public file URLs; every open is checked on the server.
Fresh-OTP access
Documents open only after a recent verified login.
Server-side blurred previews
Unverified users get a light 80-pixel preview, never the original image.
WhatsApp OTP with SMS fallback
Codes over the Meta Cloud API, SMS when WhatsApp is unavailable.
Token-bucket rate limits
On every code sent and every code checked.
Flood guard
Bursts against public forms and endpoints stopped early.
Technology
Platforms: Cloudflare edge.
Services used
Have a product in mind? Let’s build it.
Tell us what you want to build. You’ll get a clear plan, timeline and quote within two working days, and the first call is free.