Filestack partners with Fastly to scale their business, enhance security

When Filestack came to Fastly six years ago, the company was looking for a CDN to continue to scale their rapidly growing file management service. Since then, they have expanded their use of Fastly to meet their changing business needs. Increasingly focused on bolstering their security posture, they have added Fastly’s next-generation web application firewall (WAF), and have begun exploring multiple security-related use cases for Compute, Fastly’s new serverless compute environment. Along with Fastly’s TLS management, these solutions have helped Filestack move both content delivery and security to the edge.

"Since Filestack started with Fastly, Fastly has grown from being an amazing CDN to also being an edge computing provider that is really focused on security. We get [terrific] support, and we have the ability to customize how we route traffic and what we do with our traffic via Fastly, so we don't have to do it on our infrastructure…[Of] course I would recommend Fastly."
Slawomir Zabiewicz, VP of Engineering

Fastly enables Filestack to scale data transfer by nearly 20x

When Filestack first started, their focus was on providing tools for file uploads. When customer needs led them to add support for related services like file transformation and delivery, they knew they needed a CDN to scale their services in a way that was reliable, cost-effective, and fast. Filestack compared CDNs side by side using a list of key features including:

• Purging and invalidation: A major part of Filestack's service is in image transformation, so they end up with multiple versions of the same file. The ability to invalidate these versions, using wildcard invalidation or surrogate keys, was critical to serving the right one. Before working with Fastly, it could take 15 minutes for a file to be invalidated; with Fastly, it happens in seconds.


• Customization at the edge: The ability to customize configurations was also high on Filestack's wish list, and Fastly's custom Varnish Configuration Language (VCL) was able to provide it. VCL makes it possible—and fast—to optimize configurations to fit Filestack's unique needs. Fastly's configuration versioning also gives them instant, one-click rollbacks, which ensures a better experience for Filestack customers.


• Points of presence (POPs): Filestack’s wide range of demanding customers means that, when selecting a CDN, the number of POPs isn't nearly as important as their power and location. With Fastly's high-density POPs placed strategically around the globe, Filestack's delivery is ultra-fast, for a seamless user experience.


• Max file size: With file sizes growing larger and larger—think long videos for EdTech, or high-resolution images for printers and content management systems—file-size capacity is critical, so large files can be cached rather than only served from the origin.

When Filestack started evaluating CDN options in 2015, they sent out about 77 terabytes of data monthly—less than a petabyte a year. Enabled by Fastly, those numbers have increased dramatically: as of 2021, Filestack is transferring approximately 18 petabytes of data annually.

Filestack scales TLS certificate management over 30x with Fastly TLS

Securing user data is a baseline requirement for file management, which makes TLS certificate management a fundamental need for Filestack. Before working with Fastly TLS, Filestack managed certificates themselves, creating them manually, provisioning them on servers, maintaining them, and then remembering to renew them. This was a cumbersome job that distracted Filestack’s team from product development, and it didn't perform as well.

"TLS was always a big need for us—that was an important part of our initial comparison with Fastly and other platforms. Given the number of certificates we're managing, the fact that we don't have to upload our private keys for certificates—and the fact that it's done at the CDN level—is a big win for us. Then when we migrated from our previous TLS certificate provider, Fastly made it very smooth."
Slawomir Zabiewicz, VP of Engineering

Filestack was also offering users a premium feature called CNAME, which allowed their customers to format their Filestack URLs with a custom domain — essentially, hiding Filestack functionality behind their own namesake. On the back end, that required Filestack to create and manage a certificate and private key for each customer. In the early days, they were managing only a dozen TLS certificates, which taxed them enough that they were considering dropping the feature. Adopting Fastly's TLS functionality allowed them to keep it and scale to the point where they can now have hundreds of certificates.

Moving security to the edge lightens the load on infrastructure

Filestack is also ready to implement some of Fastly's newest solutions. That starts with Compute, which supports high performance, serverless computing at the edge—and off Filestack's infrastructure. Looking to the future of file handling, Filestack has identified multiple problems related to security and file uploads that can be solved through edge computing.

For example, verifying the format of file uploads is a necessary step to prevent cyberattacks by someone deliberately trying to misrepresent the file type. Filestack is working on a method of verifying files using magic bytes—basically, metadata that reveals the type of file being uploaded. Filestack will send magic bytes to Compute and analyze them there, so they can decide whether to send it through, show the error to the user, or even fix the file, without burdening their own infrastructure.

By combining features of TLS management and Compute, Filestack also plans to enhance cookie authorization. With the CNAME functionality described above, a Filestack customer can also set security policies in cookies rather than in a URL, letting them maintain control over file access, even when an end user shares the URL with someone else. Filestack can then verify the cookie at the edge before deciding whether to serve the file.

The company has also started using the next-generation web application firewall (WAF) from Signal Sciences, which is now a part of Fastly. Like many web services, Filestack offers a free plan, which tends to attract bad actors. Although Filestack uses a variety of authorization and verification methods, they wanted another line of defense. Fastly is continuously ingesting malware and malicious actor data from a range of sources, which means more threats are stopped before they even get through the front door.

"The next-generation aspect of [Fastly]'s WAF was very compelling for me because I need WAF management that is, essentially, effortless—something that can be set up really quickly but still be a major part of our security program. If I get a notification from [Fastly] that a new user is a bad actor, I can immediately block him, which is very important for me, and for our customers. I don't think any other solution on the market can give us all that."
Slawomir Zabiewicz, VP of Engineering

Reliability and "amazing support" help Filestack expand features and grow business

After six years of growth with Fastly, Filestack reports that they have never had a major issue using the platform, and the support they've received has exceeded expectations. For example, while implementing Fastly's TLS management, Zabiewicz says he spent hours talking to Fastly support and developing a strong working relationship. That level of transparency and trust has led Filestack to keep finding new Fastly features to use, and to continue moving more traffic to Fastly as the company continues its rapid growth trajectory.