Candid Moments: Durable Media Processing and Moderation

Event photo sharing has a simple user promise: guests scan a QR code and contribute photos or videos without downloading an app or creating an account. Delivering that experience responsibly requires more than putting files in object storage.

Candid Moments needs to accept bursty uploads, keep large files away from the application server, moderate eligible media, recover from provider failures, and give hosts control over uncertain results.

The product constraints

The architecture starts with the event workflow:

• Guests should reach the upload action with as little friction as possible.
• Photo and video traffic can spike during an event and fall to almost nothing afterward.
• Large uploads should not consume application-server bandwidth or memory.
• Moderation behavior needs to reflect the host's plan and settings.
• External moderation failures cannot silently lose an upload.
• Hosts need review, approval, deletion, and download controls.

These constraints favor asynchronous processing, but asynchronous does not mean ephemeral or unobservable.

The current media path

A simplified upload and processing flow is:

1. The guest enters a private event gallery through a QR code or link.
2. The application authorizes the upload and creates the required persisted state.
3. The browser uploads the media directly to Amazon S3 through a presigned request.
4. A PostgreSQL-backed PgBoss job processes the uploaded asset asynchronously.
5. Eligible media is evaluated by Amazon Rekognition using the applicable moderation settings.
6. Processing and moderation results are persisted for gallery delivery and host review.
7. Media is delivered through a CDN-backed path rather than the application server.

Direct uploads keep application instances out of the file-transfer path. PgBoss provides a durable job boundary inside the existing PostgreSQL operational model, including bounded retries and a record that administrators can investigate.

Why the job boundary matters

Media processing can fail after storage succeeds. Rekognition may be unavailable, a video may require additional processing, or a job may encounter unexpected metadata. Treating the entire workflow as a single request would couple guest latency to those downstream operations and make recovery fragile.

Persisted asset and job state lets the system distinguish between:

• Upload authorization
• Storage completion
• Processing progress
• Moderation outcome
• Retryable provider failure
• A state requiring human remediation

That separation is more important than whether the worker runs in a function, container, or long-lived process. The durable architectural decision is to record state before crossing an unreliable boundary and make retries safe.

Moderation is a control system

Amazon Rekognition supplies labels and confidence values. It does not decide the product policy by itself.

Candid Moments combines provider output with configurable thresholds and host-facing presets. Depending on the result and settings, eligible media can continue through the workflow or be held for owner review. Hosts can inspect blocked uploads and approve or delete them.

This creates two necessary escape hatches:

• The product can change moderation policy without replacing the storage pipeline.
• A host or administrator can recover when automation produces an uncertain or incorrect result.

Moderation is therefore an operational workflow with evidence and overrides, not merely an API call.

Operating the pipeline

The system needs enough observability to answer practical support questions:

• Did the upload reach storage?
• Was a processing job created and completed?
• Did moderation run, retry, or fail?
• Which state currently prevents gallery delivery?
• Can an owner or administrator resolve it safely?

Persisted failures, bounded retries, Sentry monitoring, and admin remediation tools make those questions answerable without treating every provider failure as a data-loss incident.

The broader lesson

Bursty workloads do not automatically require a Lambda-first design. They require decoupled uploads, durable state, bounded asynchronous work, observability, and recovery paths. Candid Moments implements those capabilities with presigned S3 uploads, PostgreSQL-backed PgBoss jobs, Rekognition, and host controls because they fit the product's existing application and operational model.

The Candid Moments case study covers the larger evolution from a QR upload prototype to an operable SaaS product, including payments, entitlements, gallery controls, analytics, and production hardening.