I'm allowing users to upload files to my web server. All of uploaded files are moved outside of the public directory, (later will be moved to AWS).
Currently I encrypt all of the files users upload, and upon retrieval, decrypt them. So, my question is:
What's the point of encrypting files?
I know, this question might seem silly, but really. The only way an attacker can gain access to the non-public directory is if they get access to the web server. Once the attacker does that, he'll have access to all encryption/decryption keys, and all PHP code that is responsible for file security. So, once the attacker is in, file encryption will be just a security theatre.
Is there any way I could make file encryption actually useful? If someone actually gained access to my servers, would it still be possible that files are secure and undecryptable?