WHITE PAPER 6 · DATABASE CACHING
Data increasingly lives far from the people and devices that use it. Users are spread across regions, applications run at edge locations close to them, and sensors produce readings on devices with intermittent connectivity.
Bassirah Technology — Innovation & R&D · 26 October 2026 · Free to share with attribution
Data increasingly lives far from the people and devices that use it. Users are spread across regions, applications run at edge locations close to them, and sensors produce readings on devices with intermittent connectivity. Serving that data quickly means caching it at several levels at once: on the device, at the edge, in each region and in front of the core database. This paper examines how such hierarchies are built and what each level can promise. It draws on the research on hierarchical and cooperative caching, then describes CDN tiers for data APIs, caches and replicas across regions, multi-primary replication with conflict-free data types, edge key-value stores and edge databases, and offline-first caches on devices. It covers IoT data, where freshness matters more than hit ratio and Age of Information provides the measure, and the consistency choices that every level of the hierarchy forces. It then discusses security and data residency at the edge, compares the approaches qualitatively, sets out open challenges and closes the Database Caching series with notes for platform decisions.
Three forces push caches outward from the core database. The first is latency: a request that must cross regions or continents pays for the distance on every round trip, and the consistency trade-offs that geo-distributed systems make stem largely from avoiding such round trips even when the network is healthy [1]. The second is cost and bandwidth: when data lives in another region or cloud, a cache in the consuming region can pay for itself by avoiding cross-region transfer charges [2], and IoT data volumes make shipping every reading to a central cloud inefficient [3]. The third is availability: edge computing places compute and storage close to devices partly so that they keep working when the connection to the cloud is lost [4]. Each force adds a cache level, and each level adds a copy that can be stale.
Paper 1 described caching strategies, eviction, invalidation and the pitfalls of a single cache tier, including HTTP and CDN caching. Paper 4 described tiers within one machine, from DRAM to flash. Paper 5 described invalidation and consistency between a cache and its database. This paper extends those ideas across geography and device classes. Paper 6 of the Data Storage Engines series described distributed SQL databases, whose read replicas and follower reads reappear here as cache tiers (Section 6.3).
This paper covers multi-level caching of data across devices, edge locations, regions and the core: CDN tiers in front of data APIs, regional caches and replicas, edge data stores, offline-first device caches and IoT data caching. It concentrates on peer-reviewed work and official documentation, and cites foundational work where it introduced an idea still in use. Statements about products reflect documentation accessed on 26 October 2026; edge platforms change quickly, and features may be added, renamed or retired. It does not report latency, hit-ratio, cost or freshness figures; where a source reports results, we describe them qualitatively and attribute them to the authors.
The origin or core is the authoritative database or service. A region is a cloud region or data center with its own copy or cache of data. An edge location is a point of presence close to users. A device is a phone, browser, vehicle, gateway or sensor that holds a local copy. A tier is one level of this hierarchy. A replica is a copy maintained by replication rather than by cache fills. Age of Information is the time elapsed since the newest value a receiver holds was generated [5]. A partition is a loss of connectivity between parts of the system.
Table 1 summarizes the levels a multi-level cache can use and what each typically provides. The descriptions are qualitative; actual behavior depends on the products, configuration and network.
| Level | Typical store | Typical consistency | Main strengths | Main constraints |
|---|---|---|---|---|
| Device | Embedded database (for example SQLite), local document store, browser storage | Local reads always available; sync is eventual, often with conflict-free merging | Works offline; no network cost per read | Limited capacity and energy; untrusted environment |
| Edge location | CDN cache, edge key-value store, edge database replica | Usually eventual; some stores offer per-key or per-session guarantees | Close to users; absorbs read load | Many locations to invalidate; regional regulation |
| Region | Regional cache cluster, read replica, multi-primary replica | Eventual or bounded staleness; read-your-writes with extra mechanisms | Serves a region without cross-region round trips | Replication lag; cross-region conflicts |
| Core | Primary database and its own caches | Strong | Authoritative | Distance from users; capacity and cost of serving all reads |
The questions multi-level data caches face were first studied for web caching. Che, Tung and Wang modeled cache hierarchies analytically and showed that tiers should be designed so that lower levels do not simply duplicate the contents of upper ones [6]. Summary cache let cooperating caches share compact Bloom-filter summaries of their contents instead of querying every peer, an alternative to strict hierarchy [7]. Wolman et al. found that cooperation among proxy caches brings diminishing returns beyond a modest population, because the benefit is bounded by how much the workload is shared and cacheable, not by capacity alone [8]. Two later results refine where capacity should go. eMRC shows that sizing a multi-tier cache requires understanding how misses at one tier feed the next, and approximates miss-ratio curves cheaply so that capacity can be allocated across tiers [9]. RobinHood shows, for requests that fan out to many backends, that reallocating cache capacity toward the backends that dominate tail latency beats spreading it evenly [10]. The common lesson is that each tier sees the filtered miss stream of the tier in front of it and should be sized for that stream.
Content delivery networks place servers close to users across a globally distributed platform [11], and they now cache data API responses as well as static content. Without tiering, every edge location that misses fetches from the origin independently. Tiered caching adds upper tiers: Cloudflare’s Tiered Cache answers lower-tier misses from an upper tier so that only upper tiers contact the origin [12], and Amazon CloudFront, which already has regional edge caches as a middle tier, can add an Origin Shield through which all regional caches funnel, collapsing concurrent misses for the same object into as few origin requests as possible [13]. AWS notes that this helps geographically spread audiences and suits cacheable content, not dynamic or rarely requested responses [13].
HTTP semantics govern every such tier. RFC 9111 defines freshness, validation with conditional requests, and the difference between shared caches such as CDNs and private caches in user agents [14], and RFC 5861 adds stale-while-revalidate and stale-if-error, which let outer tiers keep serving while refreshing or while the origin fails [15]. Invalidation is the hard part of a distributed tier. CloudFront supports invalidation by path and by cache tag, but AWS recommends versioned file names for frequently updated content, because invalidation does not reach caches downstream of the CDN, such as browsers [16]. Fastly lets the origin tag responses with surrogate keys, so one purge removes a related group of objects, and offers soft purges that mark content stale while a fresh copy is fetched [17]. Surrogate keys are the CDN counterpart of the tag-based invalidation described in paper 5.
Facebook’s memcache deployment shows the classic structure: caches per cluster, regional pools shared by several clusters, and regions that hold replicas of a single writable master region [18]. Invalidations are driven from the database commit log, and when a user writes from a non-master region, a remote marker redirects that user’s subsequent misses to the master region until replication catches up, limiting stale reads [18].
TAO organizes its cache into a leader tier, with one coordinator per shard in each region, and follower tiers that clients use; followers forward misses and writes to the leader, and by restricting the data model, replica-region caches can be updated at write time so that clients sharing a cache see their own writes without inter-region calls [19].
A nearby replica serving reads is a cache whose freshness is bounded by replication lag rather than by a time to live. CockroachDB’s follower reads let the replica nearest the request serve reads at a timestamp old enough to be safe, either a fixed past timestamp or the freshest one the replica can serve without blocking; safety rests on closed timestamps below which no new writes can land [20]. Cloudflare’s D1 places read-only replicas in several regions and gives each session sequential consistency through bookmarks: a replica waits until it is at least as current as the version the session last saw [21]. Upstash’s Global Database serves reads from any region and processes writes at a primary, documenting itself as eventually consistent [22]. These designs differ mainly in what they promise a session that writes and then reads.
Some systems accept writes in every region. Redis Active-Active databases are built on conflict-free replicated data types: each participating cluster accepts reads and writes locally, a syncer propagates changes, and concurrent updates are merged automatically by the data types themselves, for example by adding concurrent counter increments, rather than by discarding one write [23]. The documentation describes strong eventual consistency with an optional causal consistency setting, notes that deleted keys persist as tombstones until all instances observe the delete [23], and, for Redis Cloud, states that failover between regions is handled by the application or network layer and that Active-Active needs more memory than a standalone database [24]. Section 8 describes the theory behind such data types.
In the cloud, cache capacity is a cost choice rather than a hardware limit. MACARON’s authors argue that a cache in the consuming region pays for itself mainly by avoiding cross-region and cross-cloud transfer charges, and that it should size and configure itself, including a cheaper object-storage tier behind memory, to minimize total cost [2]. The five-minute reasoning of paper 4 applies here with transfer prices in place of device prices.
Edge platforms offer data stores that run next to edge compute, with consistency models stated in their documentation. Table 2 summarizes four documented designs.
| Store | Write path | Read path | Documented consistency | Intended use |
|---|---|---|---|---|
| Cloudflare Workers KV | Central stores | Per-location cache, then regional and central tiers | Eventual; read-your-writes not guaranteed, even at the writing location | Read-heavy, highly cacheable data |
| Cloudflare Durable Objects | One instance per object name | The same instance | Strongly consistent, transactional per object | Coordination and per-entity state |
| Cloudflare D1 with read replication | Primary database | Regional read replicas through sessions | Sequential consistency per session | Relational data read from many regions |
| Fastly KV Store | Central store | Lazily cached at each point of presence | Eventual | Runtime-updated configuration and lists |
Workers KV is itself a multi-tier cache: a read at a location is served from that location’s cache when possible and otherwise falls through regional and central tiers; popular values are refreshed in the background; negative lookups are cached; and the documentation recommends Durable Objects where stronger consistency or frequent writes are needed [25]. A Durable Object gives each name a single instance with private, strongly consistent storage, so it can serve as the authoritative home for an entity at the edge [26]. Fastly’s KV Store is cached lazily at each point of presence on first request, so the first read at a location is slower than later ones [27]. The pattern across platforms is consistent: eventually consistent caches for reads, plus a strongly consistent home for writes and coordination.
At the device level, the cache is often also a writable replica. Local-first software keeps the primary copy of data on the device, works offline and syncs with peers and servers when it can, treating the cloud as a secondary replica [28]. SQLite’s own guidance describes it as suited to devices that run without administration and to a local “cache for enterprise data” that reduces latency and server load and keeps applications working during outages [29].
Offline writes on many devices conflict, and conflict-free replicated data types (CRDTs) resolve them without coordination. Shapiro et al. defined state-based and operation-based CRDTs and the guarantee they provide, strong eventual consistency: replicas that have received the same updates converge, regardless of order, without rollback [30], [31]. Kleppmann and Beresford extended the idea to nested JSON documents [32], and Almeida surveys the design approaches developed since, including delta-state and pure operation-based designs [33]. Open-source libraries such as Automerge and Yjs make CRDTs available to applications, with local storage and automatic merging when connectivity returns [34], [35]. CRDTs guarantee convergence, not intent: the merged result follows each data type’s rule, and invariants that need coordination, such as uniqueness, cannot be guaranteed without it. Standard CRDTs also assume honest replicas; Kleppmann showed how to restore convergence when some replicas may be malicious, which matters for devices and edge nodes outside an operator’s control [36].
Sync systems connect device caches to servers. Couchbase Lite replicates with a server-side Sync Gateway in push, pull or both directions, and retries when the remote is unreachable [37]. CouchDB replication is driven by a changes feed, resumes from checkpoints, and can produce conflicts that the application resolves [38]; PouchDB implements the same protocol in the browser so web applications can work offline [39]. PowerSync keeps an in-app SQLite database synchronized with a backend database such as PostgreSQL [40]. The device tier also carries platform risk: MongoDB retired its Atlas Device Sync service, which reached end of life after a deprecation period, leaving teams to replace the sync layer while keeping the local store [41].
IoT systems generate data continuously at the edge of the network. Shi et al. argue that edge nodes should cache, filter and pre-process IoT data rather than ship all of it to the cloud [3], and surveys of edge caching organize the field around where to cache, what to cache and how [42], including caches at base stations, edge servers and devices in mobile networks [43]. Sensor readings are often transient, losing value after a limited lifetime, which makes caching them a distinct problem from caching content [44].
For sensor data, freshness matters more than hit ratio. Age of Information measures, at the receiver, how long ago the newest value it holds was generated; Kaul, Yates and Gruteser showed that updating as fast as possible is not optimal, because queueing can make data staler [5], and Yates et al. survey the theory and its applications, including caching [45]. Pappalardo, Virdis and Mingozzi apply it to IoT edge caches, setting refresh parameters to meet freshness requirements while minimizing the energy constrained devices spend sensing and transmitting [46]. The lesson for multi-level caches is to set freshness targets per data stream and measure age, not only hits.
Simple last-value caches are common in IoT. MQTT retained messages keep the most recent message per topic at the broker for new subscribers, and a message expiry interval discards it when it becomes too old [47]. Time-series databases offer similar features: InfluxDB 3 keeps the latest values per series in memory so that “latest reading” queries avoid scanning stored data [48].
Every level of the hierarchy makes a consistency choice. Brewer’s refinement of the CAP theorem notes that the choice between consistency and availability matters only during partitions, so systems can detect partitions, operate in an explicit partition mode and reconcile afterwards, for example with CRDT merges [49]. Abadi’s PACELC adds that even without partitions, systems trade latency against consistency, which explains why geo-distributed and edge caches relax consistency when the network is healthy [1]. Between strong and eventual consistency lie guarantees that users notice directly. Terry et al. defined four session guarantees, read your writes, monotonic reads, writes follow reads and monotonic writes, that a client can obtain on top of weakly consistent replicas [50]; D1’s session bookmarks and memcache’s remote markers are implementations of such guarantees [21], [18]. Bailis et al. showed which transactional guarantees remain achievable while staying available under partitions, and which, such as serializability, do not [51]. COPS showed that causal consistency, stronger than eventual, can be provided for geo-replicated storage with local reads and writes [52]. For a multi-level cache, the practical step is to state, per tier and per data set, which of these guarantees a client gets and what it sees when it moves between tiers.
Edge caches widen the attack surface. In cache-poisoned denial of service, an attacker sends a request that the cache forwards but the origin rejects, and the shared cache stores the error under the normal cache key, so legitimate users receive it [53]. In web cache deception, an attacker tricks a CDN into caching a victim’s personalized response as if it were public, then retrieves it [54]. Both arise when the cache and origin interpret requests differently, and both are mitigated by strict cache keys, caching only responses explicitly marked cacheable and testing the cache and origin together. Data residency adds a regulatory dimension: a globally distributed cache may store or decrypt regulated data where it should not, and CDN providers offer controls over where traffic is processed and where metadata and keys are kept [55]. At the device and peer level, untrusted replicas can corrupt shared state unless synchronization tolerates malicious participants [36].
Table 3 compares the approaches in this paper. The ratings are qualitative and relative to each other; actual behavior depends on the products, configuration, network and workload.
| Approach | Read latency for distant users | Write path | Consistency offered | Offline tolerance | Operational effort |
|---|---|---|---|---|---|
| Core database only | High | Single primary | Strong | None | Low |
| CDN tiers in front of data APIs | Very low for cacheable responses | Origin | Freshness and validation rules; purge is asynchronous | Stale-if-error during origin failures | Medium |
| Regional caches over one primary | Low | Primary, with invalidation from the log | Eventual, plus session mechanisms | Low | Medium |
| Read replicas and follower reads | Low | Primary or leaseholder | Bounded staleness or session consistency | Low | Low to Medium |
| Multi-primary with CRDTs | Low | Local in every region | Strong eventual, optionally causal | Medium (regions continue during partitions) | Medium |
| Edge key-value and edge databases | Very low | Central store or per-object home | Eventual, per-object strong or per-session | Low to Medium | Low (managed) |
| Offline-first device caches | Very low (local) | Local, synchronized later | Strong eventual via CRDTs or application merges | High | Medium to High |
| IoT edge and last-value caches | Very low | Device to edge | Freshness bounded by refresh and expiry | Medium | Medium |
Challenge. Edge and device tiers must stay available during partitions, which rules out some guarantees [49], [51]. Research direction. Causal and session guarantees over weak replicas [50], [52], and conflict-free data types with richer semantics [33]. Opportunity. Clear, per-tier guarantees that applications can rely on would make edge caching safe for more data.
Challenge. CRDTs guarantee convergence, not the result a user intended, and cannot enforce invariants that need coordination [30], [33]. Research direction. New data types and hybrid designs that coordinate only for the operations that need it [33], [51]. Opportunity. Merges that respect application rules would make offline-first applications practical for business data.
Challenge. Each tier sees a filtered miss stream, and the best placement depends on workload, latency and transfer costs [9], [2]. Research direction. Miss-ratio modeling for multi-tier caches [9], cost-driven self-configuration [2], edge caching frameworks [42], and learned placement, which paper 2 introduced for single caches. Opportunity. Tiers that size and place themselves from live traffic and prices would replace hand-tuned hierarchies.
Challenge. Refreshing sensor caches more often costs device energy and bandwidth, and refreshing as fast as possible can make data staler [5], [46]. Research direction. Age-of-Information-aware refresh and caching [45], [46]. Opportunity. IoT caches that meet stated freshness targets at minimum energy would extend device life and reduce network load.
Challenge. Purging or invalidating data at many edge locations is asynchronous and does not reach caches beyond the CDN [16]. Research direction. Tag-based purging [17], versioned resources [16], and the dependency-driven invalidation described in paper 5. Opportunity. Invalidation that reaches every tier predictably would let teams cache more dynamic data at the edge.
Challenge. Disagreements between cache and origin create attacks [53], [54], and caches can place regulated data in the wrong jurisdiction [55]. Research direction. Systematic testing of cache and origin behavior and Byzantine-tolerant synchronization for untrusted replicas [36]. Opportunity. Edge caches that are secure and residency-aware by default would widen the set of data that can be cached close to users.
Challenge. Staleness and misses at one tier show up as symptoms at another, and few systems measure freshness end to end. Research direction. Freshness metrics such as Age of Information [45], consistency measurement as described in paper 5, and miss-ratio modeling across tiers [9]. Opportunity. End-to-end views of hit ratio, staleness and cost per tier would make multi-level caches operable.
Challenge. Edge and device platforms evolve quickly, and services can be retired, as MongoDB’s device sync service was [41]. Research direction. Open protocols and libraries for sync, such as CouchDB replication and open-source CRDT libraries [38], [34], [35]. Opportunity. Designs that separate the local store from the sync service reduce the cost of changing providers.
Map each data set to the tiers that need it and state, per tier, the freshness and consistency a client gets. Put CDN tiers and origin shields in front of cacheable API responses, with explicit freshness rules and tag-based purging. For regional reads, prefer read replicas or follower reads with session guarantees where users must see their own writes, and choose multi-primary replication only where local writes in every region justify conflict-free data types and their memory cost. Use edge key-value stores for read-heavy data, with a strongly consistent home for writes. For devices, design local-first with a clear merge model and keep the local store independent of any one sync provider. For IoT data, set freshness targets and measure age as well as hits. Test cache and origin together for security, and place regulated data deliberately.
For in-memory caching across regions, Bassirah works with Redis as a Strategic Technology Partner; Redis Active-Active provides multi-primary geo-distribution with conflict-free data types, with the trade-offs its documentation states. Other products and projects named in this paper are ecosystem references. In each case, validate the design on representative workloads, network conditions, failure scenarios and versions before relying on it.
This paper closes the Database Caching series. Paper 1 set out the strategies, architectures, eviction policies and pitfalls of a single cache; papers 2 to 6 examined learned policies, semantic caching for AI applications, memory and storage tiers, precise invalidation and, here, hierarchies across geography and devices. One lesson recurs: a cache is a second copy of the truth, and the design work is in deciding how far that copy may drift, then measuring that it does not drift further.
Product and project names are trademarks of their respective owners. Their mention describes publicly documented technology and does not imply a business relationship, except where Bassirah names a Strategic Technology Partner.
About this paper.
A technology survey of published research and publicly documented systems. It does not report Bassirah benchmarks or customer results. Product and project names are trademarks of their respective owners; their mention does not imply a business relationship, except where Bassirah names a Strategic Technology Partner.
THE SERIES
The foundation paper covers the core patterns; each research paper takes one frontier in depth.
Tracking what cached data depends on, so that changes invalidate exactly what they should.
Caches that span DRAM, CXL-attached memory and flash, and the placement and endurance trade-offs between tiers.
Reusing answers and computation by meaning, with the correctness, access control and evaluation questions it raises.
Bring one workload and its freshness requirements to a short architecture workshop. We will map it to the strategies in this paper and plan how to validate the design.