ComparisonsTech

B2B Image Hosting RFP Checklist 2026: 15 Technical Must-Haves Before You Sign

Published on4/14/202612 min read

Buying an image hosting service for your company is more like buying a database than picking a SaaS trial. The landing page hero section tells you nothing useful.

My team asked me to evaluate a replacement vendor last year. I took every production incident and billing surprise from the past three years and turned them into a checklist. This document is not a "which CDN has more PoPs" comparison. It is the kind of table you paste into an RFP and ask vendors to answer "Yes / No / Partial" on each line. Under the surface, image hosting services that look identical have wildly different architectures.

If you just want to know which service is free or cheapest, check out the free image hosting comparison or Imgur alternatives instead. This article is for engineering leads, SaaS procurement teams, and DevOps engineers.

The 15-Point RFP Checklist (Copy-Paste Ready)

Below is the exact table I use in vendor evaluations. Every item has a verification method. Asking "do you support this?" is not verification, because vendors always say yes.

#	Spec	Verification method	Pass criteria
1	S3 API compatibility	Run `s3api list-objects-v2 --prefix`	Response schema matches AWS
2	Multipart Upload	Upload 500MB file, interrupt, resume	Supports part retry
3	Pre-signed URL	Generate a 15-min URL and verify signature	HMAC-SHA256, configurable TTL
4	Webhook events	Trigger upload/delete events	HMAC signature + retry mechanism
5	Rate Limit policy	Run burst test	Returns 429 + Retry-After header
6	SLA terms	Read the MSA	≥99.9%, includes service credit
7	Availability zones / multi-region	Request region list	≥2 regions, cross-region sync
8	Egress pricing	Request pricing sheet	Transparent per-unit cost, tier discounts
9	Image processing pipeline	Test on-the-fly transforms	Supports WebP/AVIF, URL parameters
10	CDN edge nodes	Run global ping tests	≥50 PoPs, includes Asia-Pacific
11	EXIF / Metadata control	Upload a photo with GPS data	Selective strip supported
12	Authentication methods	Review API docs	Supports OAuth2 + API Key rotation
13	Audit logs	Ask about log retention	≥90 days, exportable
14	Compliance certifications	Request SOC 2 / ISO 27001 report	At least one
15	Data residency & deletion	Review DPA terms	Region-pinning, hard delete supported

Do not just tick Yes/No. Require the vendor to attach documentation links or technical verification steps for each item. In practice, anything without documentation is "planned but not built."

Why B2B Image Hosting Selection Is Nothing Like Picking a Personal Tool

Individual users care about two things: "Can I upload?" and "Is the link easy to share?"

Enterprise buyers care about a completely different set of questions. Does the contract specify an SLA? How does the API degrade when rate limits are hit? Will Egress fees double without warning one month? When a GDPR auditor asks how long EXIF data is retained, can you answer?

In short, B2B image hosting procurement is about buying three things: a predictable cost curve, verifiable system guarantees, and integrable protocol interfaces. The 15 items above all map back to these three.

I learned this the hard way: a free tier can survive a demo but not production traffic.

Implementation Details That Vendors Love to Gloss Over

The checklist is a skeleton. The items below are where vendors most often get vague during contract negotiations.

S3 Compatibility Is Not a One-Line Claim

"We're S3 compatible" is the most common claim from image hosting vendors. But S3 has over 200 API operations. What matters is whether the subset you actually use works correctly.

Everyone supports GetObject and PutObject. Go deeper:

# Test multipart
aws s3api create-multipart-upload --bucket test --key big.mp4 \
  --endpoint-url https://vendor.example.com

# Test versioning
aws s3api put-bucket-versioning --bucket test \
  --versioning-configuration Status=Enabled

# Test lifecycle
aws s3api put-bucket-lifecycle-configuration ...

In my testing, fewer than 60% of vendors pass all three. Bucket lifecycle and object lock are the most common gaps, and missing them creates compliance audit problems.

Pre-signed URL: TTL and Signature Algorithm

This is the most common auth method in B2B scenarios. Your end users do not have your credentials; you issue them a time-limited ticket.

The underlying mechanism is HMAC-SHA256: the method, path, expiry, and headers are packed into a string-to-sign and signed with a secret key. A good vendor provides:

Configurable TTL (anywhere from 1 minute to 7 days)
Source IP restriction (aws:SourceIp condition)
HTTP method restriction
SigV4 support (SigV2 is deprecated; any vendor still using SigV2 is an automatic disqualification)

A bad vendor gives you a "never-expiring public URL" and calls it signed. This is exactly why Pre-signed URL support needs to be explicit in the RFP.

Webhook Signature Verification: I Got Burned Here

Webhooks are essential for event-driven architectures. Upload complete, virus scan complete, transcoding complete. Each should push an event to your system.

But webhook security is where vendors most often cut corners. Bad implementations I have personally encountered:

No signature at all, just a raw POST
Signature present but secret embedded in the query string
Signature present but using MD5
Signature present but no timestamp, making replay attacks trivial

A compliant webhook must have:

HMAC-SHA256 signature in the X-Signature header
X-Timestamp header, reject requests older than 5 minutes
Automatic retry on failure (exponential backoff, at least 3 attempts)
Dead letter queue or replay API

Here is what webhook verification looks like in Go:

func verifyWebhook(body []byte, sig, ts, secret string) bool {
    if time.Since(parseTS(ts)) > 5*time.Minute {
        return false
    }
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(ts + "." + string(body)))
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(sig), []byte(expected))
}

Without that timestamp check, replay attacks blow right through your entire event system.

Rate Limits: Two Layers to Evaluate

Rate limits have two dimensions: what your quota is and what happens when you exceed it.

Quota is straightforward, usually per-second or per-minute, listed in the plan. The real question is the over-limit behavior:

Behavior	Compliance
Hard 503 disconnect	Fail
429 without Retry-After	Partial
429 + Retry-After header	Pass
429 + Retry-After + quota headers	Excellent

Bonus points for X-RateLimit-Remaining headers that let your code throttle proactively instead of eating 429s.

SLA Terms: The Devil Is in the Exclusions

Everyone claims 99.9%. That equals 43.2 minutes of downtime per month. 99.95% is 21.6 minutes. 99.99% is 4.3 minutes.

But the real value of an SLA is not in that number. It is in the exclusion clause. Read every line:

Does scheduled maintenance count as downtime?
Do regional outages count?
Do DDoS periods count?
Do third-party dependency failures (e.g., upstream DNS) count?

More importantly, look at the service credit mechanism. How much is refunded when the SLA is missed? Is it account credit or cash? Does credit accumulate or expire?

Honestly, most SLAs look great on paper. When you actually file a claim, most get blocked by exclusions. So during procurement, do not fixate on the percentage. Ask for the real incident history from the past 12 months, which can be provided under NDA. For vendors serving US government workloads, also check for FedRAMP authorization, which adds an additional layer of operational accountability.

Egress Pricing: The Hidden Cost Trap

Egress (outbound bandwidth) is where image hosting budgets blow up. The classic vendor trick: cheap storage, expensive egress.

Looking at the numbers, egress pricing among major vendors can differ by 10x or more. Cloudflare R2 offers zero egress (within their own network), Cloudinary uses a credit model, imgix charges per request. Which one saves money depends entirely on your traffic profile.

Before signing, get clear answers on three things:

Are there tiered volume discounts? Typically significant discounts kick in above 10TB/month
Does internal cross-region traffic count as egress?
Do CDN cache hits count as egress? Some vendors count CDN cache hits as billable traffic

I got burned on this one: test environment was 200GB/month, no problem. After launch, traffic hit 8TB overnight and the bill gained an extra zero. The contract did not specify overage behavior, so we ate the full cost that month.

Three Specs Everyone Overlooks

These three items do not appear in most "image hosting comparison" articles, but they cause real pain in production.

EXIF and Metadata Compliance

EXIF data contains GPS coordinates, camera serial numbers, and timestamps. When uploaded to a public image host, all of this metadata ships with the image by default.

In B2B scenarios, ask:

Can EXIF fields be selectively removed (strip GPS but keep copyright)?
Is IPTC / XMP metadata manipulation supported?
Is metadata processing done at upload time or on-the-fly?

Both GDPR and CCPA (along with other US state privacy laws) classify GPS coordinates as personal data. Mishandling this transfers compliance risk directly to your company.

Hybrid Authentication: OAuth2 + API Key

Legacy image hosts only offer API Keys. Modern B2B requires a hybrid approach:

System-to-system: API Key + IP allowlist
User-facing SPA: OAuth2 PKCE flow
Temporary access: Pre-signed URL

If a vendor gives you a single permanent API Key and tells you to manage scopes yourself, they are pushing security risk onto the customer. A proper solution should support scoped tokens, automatic rotation, and revocation APIs.

Hard Delete and Data Retention

GDPR "right to be forgotten" requests must be honored within 30 days. Many image hosts say "we delete it," but in reality it is a soft delete: the object is still in S3, in the CDN cache, on backup tapes.

During procurement, confirm:

Is deletion written into the DPA (Data Processing Agreement)?
Do backup cycles include corresponding deletion mechanisms?
Can the vendor provide deletion certificates?

I dealt with a real case: a client received a GDPR deletion request, but the vendor's cold storage backups had a 365-day retention that could not be overridden. Legal back-and-forth lasted three months.

CDN Edge Nodes and Real-World Latency

PoP numbers are often inflated. A vendor claiming "300+ PoPs" might have 280 in North America and Europe and 5 in Asia-Pacific.

Verification is simple: get the vendor's anycast IP and run mtr from VPS instances in different regions (US East, Tokyo, Singapore, Frankfurt, Sao Paulo). Anything above 80ms round-trip is not acceptable.

If your Asia-Pacific users are hitting a CDN that routes back to US West, that is 150ms+ minimum. Frontend image load times suffer noticeably. In B2B SaaS, especially e-commerce and media, this directly impacts conversion rates.

Where lpic.cc Fits

I should be honest: lpic.cc is not an enterprise-grade B2B solution right now.

We target individual developers, bloggers, and forum users with free uploads, password protection, and 30-day retention. The backend runs on Cloudflare R2 with a custom API, and the architecture does use several techniques discussed in this article (Pre-signed URL, webhooks, EXIF processing). But we do not offer enterprise SLA, SOC 2 certification, or DPA.

If you are an engineering lead evaluating production-grade image hosting, take this checklist and apply it to Cloudinary, imgix, Cloudflare Images, or ImageKit. If you need a lightweight solution for personal use or a small team, give lpic.cc a try. Upload something for free and see if it fits your needs.

FAQ

Q1: Does a small team really need enterprise-grade image hosting?

Not necessarily. Under 10K MAU and less than 500GB/month, you can build a working layer on top of Cloudflare R2 + Workers for under $5/month. Enterprise solutions add value through SLA, compliance, and support SLA, which a small team may not need. But if you serve B2B customers and their contracts require DPA, there is no workaround.

Q2: Does S3 compatibility actually matter? Don't all image hosts support it?

It matters a lot. S3 is the de facto standard API. Compatibility means you can use mature SDKs, Terraform providers, and backup tools. Incompatibility means you are locked into a proprietary API with high future migration costs. This is a textbook vendor lock-in indicator.

Q3: Why webhooks over polling?

Polling means you ask "done yet?" every N seconds. Webhooks mean the vendor pushes a notification when something finishes. The difference is in latency (seconds vs milliseconds) and cost (your API call quota vs zero). For events like upload completion, transcoding, and virus scanning, real-time UX is impossible without webhooks.

Q4: Is the difference between 99.9% and 99.99% SLA really that big?

Numerically, it is 43 minutes vs 4 minutes per month. Whether that matters depends on your business. If the images are product photos in an e-commerce checkout flow, every minute of downtime is lost revenue. If they are images in an internal employee handbook, 99.9% or even 99% is fine. Match SLA requirements to actual business impact instead of chasing higher numbers blindly.

Q5: Cloudflare R2 has zero egress. Is it always the right choice?

No. R2's zero egress only applies within Cloudflare's network (via Workers or CDN). Pulling data from R2 into another cloud provider still incurs charges. Additionally, R2's Class A operation pricing (write operations) is not cheap. For write-heavy, read-light workloads, R2 may not save money. Do the full math based on your read/write ratio.

References

#image hosting API#S3 compatible#SLA#CDN#Webhook#enterprise procurement#DevOps#Signed URL

Written by

Harvey Zhang

Co-Founder & CTO

Backend engineer turned architect, offering deep technical analysis of image hosting infrastructure.