Another option is to use a cloud storage service that supports fine grained access control (e.g. write-only vs read-only) and retention polices.