URL Shortener & Link Management Service  ·  View 11 of 23  ·  Data

Storage Zones

Three zones, three different recovery plans — and the zone a dataset sits in is what tells you its plan.

Editable source SVG draw.io All views
Authoritative — lost data is lost business Link table · Cosmos DB Link records 12B · RPO 0 Native TTL expiry, eventual Reservation index · strong (domain, code) claims conditional create Tenancy Tenants and domains verification state API keys and secrets Key Vault Derived — disposable, rebuildable in 30 minutes Read path Hot set Redis, 12 regions Negative cache unknown codes Edge response cache 30 s Revocation Deny-set compact, fast channel Tenant indexes Links by tenant listing and search Evidential — append only, never updated Click data · Azure Data Explorer Raw click events 90 days Daily rollups 25 months Monthly rollups 5 years Decisions Audit log 400 days, immutable Abuse evidence 2 years Edge click buffer Event Hubs · 30 s RPO projection claim then write bounded by TTL ingest materialise Storage Zones — Ownership, Consistency and Rebuildability Data store Security / platform Queue / topic event / async synchronous batch Zone tells you the recovery plan: authoritative is replicated and backed up, derived is thrown away and rebuilt, evidential is written once and never corrected. The by-tenant index is built from the same change feed as the hot set. v 1.0 · owner Platform Architecture · date 2026-09

What each zone means

  • Authoritative: replicated, RPO 0, backed up. Losing it is losing the business.
  • Derived: thrown away and rebuilt from the link table within 30 minutes, with no operator input. Never backed up.
  • Evidential: append-only, never updated, retained on a schedule and used to answer questions about what happened.

Retention

  • Raw click events 90 days, daily rollups 25 months, monthly rollups 5 years.
  • Audit records 400 days; abuse decisions and their evidence 2 years.
  • Link records until the tenant deletes them; the reservation record outlives the link so a retired code can never be claimed again.

Risks

  • The deny-set is in the derived zone but carries a safety promise. If a rebuild does not restore it first, a 30-minute rebuild window is also a 30-minute window in which killed links resolve.
  • Assumption: 4% of links are clicked in any 30-day window, which is what makes the derived zone affordable. If the real figure is 20%, the hot-set sizing and the cost per million redirects both change.
◀  Integration Surface All views Data Model  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records11-storage-zones