Hi John
Basically You can encrypt the file with many ways like
Method1: Convert file to string[JA] and encrypt the string using mendix encryption module with the key and decrypt the string and use JA string to file to get the original file. Here the key rotation will be manual using logical and re-encryption needed for all files.
Method2: PGP: create key chains using mendix encryption module to generate public and private key then use encrypt and decrypt using microflows from the module. Key rotation will be as same as above.
if you are hosting the application in private cloud and planning to manage from there then you can go for KMS valuts or HashiCorp Vault Best for On-Premise and key rotation is automatic . If you want I can help on these