Best is to create your own API endpoint that accepts and saves files. The upload plugin for sensitive data is quite useless.