Keep every file in your own S3 bucket, or use ours.
Your team signs in through your own SSO, and documents stay private behind it.
Every action and view recorded, including who did what, when, and who opened each document.