Private file uploads

Design a file-upload feature for a small app where users attach documents (PDFs, images, up to ~20 MB) to records. Files must be stored durably, associated with the right record, and only the owner should be able to download them later. Upload volume is modest. Describe the upload flow, where files live, and how downloads are kept private.