Designing a Secure, Scalable Brand Kit Module for Canva’s Design Editor

Problem Statement

Canva users need a way to upload brand assets—logos, color palettes, fonts—and have those assets instantly available across all design projects. The assets must be stored durably, served with low latency, and respect per‑user or per‑team permissions. The design must be secure, scalable, and resilient to common failure modes.

Core Requirements

• Instant availability of uploaded assets in any design draft.
• Durable storage with encryption at rest and in transit.
• Fine‑grained access control per user or team.
• Low‑latency global delivery via CDN.
• Auditability for upload, delete, and download events.
• Compliance with GDPR/CCPA data‑subject requests.

Minimal Suitable Design

The simplest architecture that satisfies the requirements is a stateless microservice exposed via REST. It orchestrates three core layers:

• Metadata Store – A relational database (PostgreSQL) holding asset metadata (UUID, owner_id, type, checksum, CDN URL, permissions).
• Object Store – An S3‑compatible bucket for binary assets, partitioned by user namespace.
• CDN – CloudFront (or similar) for global, low‑latency delivery.

All communication uses HTTPS; the microservice runs behind an API gateway that enforces rate limits and authentication via JWTs containing scope claims.

REST API Sketch

POST /brand-assets
  Headers: Authorization: Bearer <jwt>
  Content‑Type: multipart/form-data
  Body: file=logo.png, type=logo

Response 201
  {"assetId":"550e8400-e29b-41d4-a716-446655440000","cdnUrl":"https://cdn.canva.com/550e8400-e29b-41d4-a716-446655440000.png"}

Example Upload Command

# Run on a developer machine
curl -X POST \
  -H "Authorization: Bearer <jwt>" \
  -F "file=@/path/to/logo.png" \
  -F "type=logo" \
  https://api.canva.com/brand-assets

Expected checks: 200‑201 status, assetId returned, CDN URL reachable.

Trust and Data Boundaries

• All uploads are scoped to owner_id or team_id stored in the JWT.
• Object keys follow /{namespace}/{uuid}.{ext} to isolate namespaces.
• Encryption keys rotate quarterly; KMS is used for server‑side encryption.
• Signed URLs (expires in 15 min) are generated for CDN fetches to prevent unauthorized access.
• Audit logs capture upload, delete, and download events with timestamps and actor IDs.

Operational Checks

• File validation: MIME type, size (<5 MB for logos, <20 MB for fonts), and SHA‑256 checksum.
• Rate limiting: Max 10 uploads/min per user.
• Cache control: CDN objects set to Cache‑Control: max-age=86400 with ETag for stale‑while-revalidate.
• Health monitoring:
  • Database replication lag < 2 s.
  • Object store availability via health‑check endpoint.
  • CDN edge latency < 200 ms in >95th percentile.
• Quota enforcement: Per‑user storage limit, with alerting when 80 % used.

Failure Modes and Mitigation

Failure	Detection	Mitigation
Upload network error	HTTP 5xx or timeout	Retry with exponential back‑off up to 5 attempts; notify user after failure.
Object store write failure	S3 error code 503	Queue upload for eventual consistency; log event for ops.
CDN outage	Edge request timeout	Fallback to origin (object store) with increased latency; cache‑control header ensures repeat requests hit CDN once restored.
Permission violation	JWT missing scope or mismatch with asset owner	Return HTTP 403 with JSON {"error":"access_denied","reason":"team_mismatch"}.
Checksum mismatch	Computed hash differs from stored hash	Quarantine asset in a separate bucket; alert user and admin.

Conditions That Prompt Redesign

• Massive Scale: >10 M brand assets → sharding metadata DB by hash of owner_id, migrating to a multi‑tenant object store with per‑bucket IAM policies.
• Legal Compliance: GDPR/CCPA data‑subject requests → reversible encryption (e.g., envelope encryption with key‑rotation) and an explicit /brand-assets/{id} delete endpoint that purges from CDN, object store, and metadata.
• External Verification: Integration with brand‑verification services (e.g., logo authenticity) → a pre‑upload validation step that blocks or flags assets before persistence.
• Font Licensing: Users upload custom fonts → enforce license checks via a third‑party API; reject non‑compliant uploads.

Practical Verification Checklist

1. Simulate a full upload flow: verify asset appears in CDN after <1 s and metadata record in DB.
2. Block CDN endpoint (e.g., iptables drop) and confirm the microservice falls back to origin without user error.
3. Attempt to download another team’s asset; ensure HTTP 403 and correct error body.
4. Introduce a network partition during upload; confirm retry logic triggers and final status is 201.

Conclusion

The outlined architecture delivers the core brand‑kit requirements with minimal complexity. By isolating data per namespace, encrypting at rest and in transit, and leveraging CDN signed URLs, the system balances security, performance, and compliance. Operational checks and well‑defined failure modes ensure resilience, while clear triggers for redesign keep the design future‑proof.