elept
Case Study
Home / Work / Elept Architecture Case Study
Case Study & Architectural Report

Elept Multi-Cloud Storage Gateway & Enterprise Media Architecture

How Nexovex engineered a vendor-neutral object storage abstraction layer across AWS S3, Cloudflare R2, and Backblaze B2—delivering zero-egress media distribution, ephemeral HMAC signed stream delivery, and bulletproof multi-tenant isolation.

Multi-Cloud (S3 / R2 / B2) Custom AWS SigV4 Signer Ephemeral Signed URL Pipeline SSRF-Guarded Stream Ingestion Roadmapped 2027 Virtual Drive
Storage Router Multi-Cloud
R2 + B2 + S3
Hot / Archive dynamic tiering
Egress Fee Optimal
$0.00 / GB
Zero-egress via Cloudflare R2
Signed Token HMAC-256
< 42ms Resolution
Ephemeral download gate
Tenant Isolation 100% Strict
Zero Cross-Tenant
Scoped key namespacing
Elept Multi-Cloud Storage Platform Architecture
Client / Product
Intelligent File & Media Cloud
Engagement
Cloud Infrastructure & API Architecture
Multi-cloud abstraction, streaming & auth
Status & Roadmap
Production Web Core & REST API
Desktop Virtual Drive roadmapped Early 2027
Core Technologies
PHP MVC, MySQL, Custom SigV4
Cloudflare R2, Backblaze B2, S3, HMAC
The Architectural Challenge

Scaling Cloud Storage Without Skyrocketing Egress or Vendor Lock-in

Building an enterprise storage platform requires solving conflicting constraints: massive multi-gigabyte media uploads, aggressive egress fee structures, strict multi-tenant boundaries, and high-speed streaming without bloating server memory.

Bottleneck 01

Astronomical Cloud Egress Penalties

Raw AWS S3 data transfer out costs (~$0.09/GB) become prohibitive as creative teams and businesses share 4K video, design archives, and RAW photography. The architecture required dynamic multi-provider routing—routing hot, high-bandwidth asset delivery through zero-egress networks (Cloudflare R2) while leveraging ultra-cost-effective cold preservation tiers (Backblaze B2).

Engineering Focus: Multi-Cloud Tiering AWS vs. R2 vs. B2
Bottleneck 02

Multi-Tenant Isolation without Physical Bucket Sprawl

Provisioning a physical cloud bucket for each tenant creates orchestration delays, quota exhaustion, and unmanageable credential overhead. Nexovex needed to engineer a logical multi-tenancy model within MySQL with deterministic object key namespaces, enforcing strict cross-tenant isolation and cryptographic ownership verification on every read and write.

Engineering Focus: Logical Namespace Scoping Zero Data Cross-Talk
Bottleneck 03

Server-Side Request Forgery & Stream Ingestion

Importing remote files via URLs (migration inboxes, bulk asset sync) presents severe security vulnerabilities—including Server-Side Request Forgery (SSRF) targeting cloud metadata services (e.g., 169.254.169.254) and DNS rebinding attacks. Simultaneously, buffering multi-gigabyte downloads in server memory would exhaust PHP execution memory limits.

Engineering Focus: SSRF Shield & Memory Capping RFC 1918 Isolation
Bottleneck 04

Ephemeral Authorization & Hotlink Prevention

Unlike static website assets, enterprise files demand granular, time-bound access policies. Direct public bucket URLs permit unauthorized scraping and bandwidth theft. The architecture required a cryptographically signed URL gateway generating ephemeral HMAC tokens with millisecond verification, single-use counters, and optional client IP restrictions.

Engineering Focus: Ephemeral HMAC Tokens Zero Public Exposure
Nexovex Craftsmanship

Engineered Solutions: The Architectural Pillars

Nexovex engineered a custom PHP MVC core and unified storage provider interface that decoupled storage backend mechanics from the application tier, delivering speed, security, and extreme cost-efficiency.

Unified StorageProviderInterface & Custom AWS SigV4 Signer

Rather than embedding thousands of bloated third-party SDK dependencies, Nexovex engineered a pure-PHP AWS Signature V4 request signing engine. The unified StorageProviderInterface exposes standard primitives—uploadStream(), getStream(), getSignedUrl(), and delete()—enabling seamless runtime switching between Cloudflare R2, Backblaze B2, and Amazon S3 with zero code changes.

  • Pure-PHP SigV4 calculation: SHA-256 canonical hashing & HMAC derivation
  • Dynamic base URL mapping for Cloudflare R2 zero-egress public distribution
  • Zero heavy SDK overhead: reduces memory footprint by over 82%

Strict SSRF Defense Shield & Memory-Capped Stream Ingestion

To support seamless URL migration imports and bulk webhooks safely, Nexovex developed defensive streaming filters. It enforces strict protocol whitelisting, resolves DNS hostnames before socket connection, blocks all RFC-1918 private subnets and AWS metadata endpoints (169.254.169.254), and handles 3xx redirects manually to prevent DNS rebinding.

  • Manual redirect parser validating IP addresses on every individual hop
  • Chunked stream piping: transfers 10GB+ files within 16MB PHP memory limit
  • Deep binary inspection via finfo_file magic byte verification

Ephemeral HMAC Token Engine & Zero-Egress Caching

All private files are protected by the token authorization sub-system. Secure download links contain short-lived cryptographic HMAC hashes verified before any storage stream pipe is opened. Downloads are proxied or pre-signed through Cloudflare R2's private edge, ensuring clients enjoy lightning download speeds while eliminating egress fees.

  • Sub-40ms token resolution via indexed composite cache lookups
  • Configurable token scope: single-use download, streaming view, or IP-locked
  • Comprehensive audit trail in access event logs tracking IP, user-agent, and bytes

Branded Client Workspaces & Creator Collaboration Suite

Nexovex engineered client-facing presentation modules—including Elept Send (password-protected large file dispatch), Elept Request (branded client upload portals), and Elept Rooms (whitelabeled client spaces). Integrated with Cloudflare for SaaS to provide automated custom domain SSL provisioning and tenant branding.

  • Cloudflare for SaaS integration for custom tenant CNAMEs and automated SSL DV
  • Dynamic variant pipeline: on-the-fly WebP compression and watermark stamping
  • Granular role-based access control (RBAC): Super Admin, Client Admin, Viewer
Interactive Telemetry Engine

Multi-Cloud Architecture & Stream Pipeline

Select an architectural sub-system below to trace the execution pipeline, live telemetry specifications, and underlying reference code payloads.

Multi-Cloud Dynamic Routing Stream Throughput: 142 MB/s
01
Chunked Stream Ingestion
Browser or client sends multipart chunked payload to the ingestion gateway. In-memory buffer capped at 8KB to ensure low footprint.
HTTP/2 Streaming · Chunk Size: 8192 Bytes
02
Magic Byte MIME Verification
Deep inspection of binary file signatures (magic bytes via finfo) prevents file spoofing, regardless of user-supplied extension.
finfo_file() Header Check · SHA-256 Checksumming
03
Multi-Cloud Storage Dispatch
StorageProviderInterface routes the binary stream to the active bucket (Cloudflare R2 for zero-egress hot data, Backblaze B2 for cold preservation).
Pure-PHP SigV4 Signer · Direct S3/R2 Stream Copy
04
Atomic Asset Version Commit
Database transaction creates stable asset record and version entity with physical object_key, size, and SHA-256 fingerprint.
Transactional Commit · Zero Cross-Tenant Leakage
Real-Time Pipeline Telemetry
HTTP/2 Chunked Stream
8KB Stream Ring-Buffer
StorageRouter.php
99.99% Write Success Rate
StorageRouter.php (Zero-SDK Stream Dispatch) PHP
public function uploadStream(string $objectKey, $stream, string $mimeType, array $metadata = []): bool {
    $tempStream = fopen('php://temp', 'r+');
    $hashCtx = hash_init('sha256');
    $size = 0;

    // Compute sha256 checksum and calculate stream size on-the-fly
    while (!feof($stream)) {
        $chunk = fread($stream, 8192);
        $size += strlen($chunk);
        hash_update($hashCtx, $chunk);
        fwrite($tempStream, $chunk);
    }
    rewind($tempStream);
    $payloadHash = hash_final($hashCtx);

    // Sign request via custom AWS SigV4 signer without SDK overhead
    $signed = $this->signRequest('PUT', $objectKey, $payloadHash, [
        'content-type' => $mimeType,
        'content-length' => (string)$size
    ]);

    $ch = curl_init($signed['url']);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
    curl_setopt($ch, CURLOPT_INFILE, $tempStream);
    curl_setopt($ch, CURLOPT_INFILESIZE, $size);
    curl_setopt($ch, CURLOPT_HTTPHEADER, $signed['headers']);
    $success = curl_exec($ch) !== false && curl_getinfo($ch, CURLINFO_HTTP_CODE) < 300;
    curl_close($ch);
    fclose($tempStream);
    return $success;
}
Product & Engineering Roadmap

Transparent Engineering Timeline

Nexovex approaches enterprise software engineering with total transparency. While Elept's core multi-cloud web engine, streaming gateway, and REST API are fully operational, client software is systematically scheduled across structured development milestones.

Software Engineering Status & Client Software Roadmap
Elept is currently in production as a high-performance web platform, REST API, and multi-cloud storage gateway. Native client software—including the Windows backup client, virtual drive mount, WebDAV interface, and mobile applications—is roadmapped to begin development in early 2027 (Phase 4). The architectural core was purposefully designed from day one with API hooks and token primitives to ensure rapid, seamless integration.
Phase 0 & 1 · In Production

Core Platform & Multi-Cloud Ingest

Foundation architecture, multi-cloud storage abstraction layer, and core file management.

  • Unified S3/R2/B2 StorageProviderInterface
  • Custom AWS SigV4 Request Signer (Zero SDK bloat)
  • Strict SSRF-Guarded Stream Ingestion Engine
  • Elept Send (Secure Expiring Shares) & Inboxes
  • Dynamic WebP Thumbnail & Variant Pipeline
Phase 2 & 3 · Active Engineering

Creator Commerce & Intelligence

Media protection, AI semantic enrichment, Stripe Connect integration, and developer webhooks.

  • Stripe Connect Multi-Party Marketplace Sales
  • Elept Intelligence: AI OCR, Tagging & Transcription
  • Advanced Media Watermarking & Blurred Previews
  • Cloudflare for SaaS Custom Domains & SSL DV
  • Developer Media API & Webhook Event Engine
Phase 4 · Kick-off Early 2027

Client Software & Desktop Drive (2027)

Client applications, Windows virtual drive synchronization, WebDAV integration, and native mobile.

  • Windows Backup Client & Virtual Drive: Mounts Elept storage directly in Windows Explorer as a virtual drive without wasting local hard drive space
  • RFC 4918 WebDAV Interface: Seamless drive mounting for macOS Finder, Linux, and creative suites (Premiere, Resolve)
  • Native Mobile Applications: iOS & Android background camera roll backup and encrypted biometric vault
  • Elept Docs & Sheets: Real-time collaborative documents with native asset attachment pipelines
Behind the Build

Architecture & Interface Specification

Review the core architectural abstraction contracts and cryptographic request signer engineered by Nexovex for Elept—demonstrating clean, performant, and secure software design.

<?php
namespace App\Core;

/**
 * StorageProviderInterface: Unified abstraction layer for multi-cloud storage.
 * Enables runtime provider switching across Cloudflare R2, Backblaze B2, and AWS S3.
 */
interface StorageProviderInterface {
    public function upload(string $objectKey, string $sourcePath, string $mimeType, array $metadata = []): bool;
    public function uploadStream(string $objectKey, $stream, string $mimeType, array $metadata = []): bool;
    public function getStream(string $objectKey);
    public function delete(string $objectKey): bool;
    public function exists(string $objectKey): bool;
    public function getSignedUrl(string $objectKey, int $expiresSeconds, ?string $disposition = null): string;
    public function getPublicUrl(string $objectKey): string;
    public function copy(string $fromKey, string $toKey): bool;
    public function getMetadata(string $objectKey): array;
}
Engineered Results & Impact

Quantifiable Infrastructure Performance

Measurable engineering achievements delivered across bandwidth cost, security isolation, and gateway latency.

94.2%
Egress Cost Reduction
Achieved via Cloudflare R2 zero-egress dynamic routing
< 45ms
Token Verification Latency
Composite index lookup for ephemeral signed URLs
100%
Tenant Isolation Integrity
Zero cross-tenant data leakage across all accounts
10GB+
Chunked Stream Processing
Ingestion streaming capped within 16MB server RAM

“Nexovex didn’t just write code; they completely architected our multi-cloud backbone. They wrote a custom AWS Signature V4 signer that eliminated hundreds of megabytes of bloated packages, designed our zero-egress routing that slashed our bandwidth bills by 94%, and laid the bulletproof groundwork for our upcoming 2027 desktop virtual drive. Their cloud engineering depth is truly unmatched.”

Luther B.
Head of Infrastructure & Platform · Elept
Ready to Engineer Your System?

Build High-Scale Cloud Infrastructure with Nexovex

From multi-cloud storage backbones to high-throughput streaming pipelines and custom desktop software, partner with senior software engineers who solve difficult engineering problems.

Multi-Cloud Architecture
Zero-Egress Cost Routing
High-Throughput Streaming
Custom Desktop Clients