Event-photo pipelines on Cloudflare stay safe when the public search index never holds original bytes. Prefer deriving embeddings or thumbnails into a separate store, keep originals in a private bucket or R2 binding that only a signed worker path can read, and make the public edge cache key cover only the derived objects so a purge of search results cannot expose source files. Treat original retention as an access policy problem, not a UI toggle.

Ops prove-out after wiring the split: upload a canary event set and confirm the public search path returns only derived assets, then request the original key through the public Host and confirm it is denied or unreachable. Watch origin GET rate on the private original prefix versus the public derived prefix for one deploy window — a rise on originals usually means a worker still fetches full files for every match. Keep a canary album with the prior layout beside the new path so you can tell a bad binding from a real search regression.