All files are uploaded directly to a private S3 bucket. Every time a download is initiated through a Dissipate private URL, the user is redirected to a signed S3 URL that is generated with a short TTL. The window in which someone can do that is limited