Hey Eugene,
Yeah, you can actually do that. Instead of using the /fileupload endpoint, you can handle file uploads through a backend workflow. Basically, the idea is to send the file (either as Base64 or multipart form) to your backend API workflow, then use the “Upload data as file” action to save it to your Bubble or S3 storage.
If privacy’s your main concern, you can also set up privacy rules so the file URLs are only visible to the right users.