They can upload them to a decentralised private cloud.
IPFS is not the best option IMO because it requires ongoing payments. But Autonomi requires only a one off payment and is encrypted.
My blog explains how this works for publishing websites using Autonomi Dweb, but websites are just files and the process for raw files is similar. But using Dweb you can provide a UI for downloads as a website if needed.
See: https://toast.happybeing.com
Hope that's of interest!
@jwildeboer @kkarhan