feat(file uploads): encrypted by default