This'll be unpopular, but if you want to keep it super lean and avoid being asked for compliance certs like SOC2/ISO, you could consider building it as an installable app on top of a platform your customers already trust

ie. a Salesforce App.

That way, they already use/trust the environment where the storage/processing of their sensitive data is taking place, akin to an old school 'on prem' solution (but without as much headache for you)

Worth thinking about

I worked for a company that required security clearances. We used a SaaS to store some documents. The SaaS gave our company a document outlining their security practices and we signed up to a system where their support is unable to access our instance unless we explicitly authorized it. It was enough for our company.

Gentleman’s agreement that you pinky promise you won’t peek if they don’t

I don't know what the product is (and you probably don't want to say...?) but is it something that could potentially done clientside in their browser, maybe in JS or WASM? That way you never even have to receive, much less store, their document.

I’d say take your time a spend a week learning about S3.

It’s better to piggy back on another teams hard work than build from scratch.

It's not a technical problem but a paperwork problem, it doesn't matter how do you do it, the client will want to see the ISO certifications even if your app is fully secure.

Security isn't the same thing as compliance.

Zip with password. Keep passwords in private for now.

In addition to being a 3rd party app as someone suggested, you could make it a desktop app.

You could also make it a control plane and the customers run it in their cloud. You would need a tech savvy customer who already uses say AWS.

Desktop app or Chrome extension is another possibility.

LOL. Why are you asking us?

Speak to your potential customers and find out what they'd want to see to make them trust it, and what their data requirements are.

What's the angle BTW? Please provide as much info as possible. Thx :D