Recommended production setup: private bucket storage, signed download links, and one K-1 record per investment / tax year / investor.