Secure multiple file upload PHP

I need SECURE file uploads for multiple files added to a web app built on LAMP which stores data belonging to multiple companies.

The uploaded files could be relating to an employee file like a proof of ID and these could be public or private documents or the files could be a general document such as a policy which could then be viewed by all employees.

As well as the file itself, the uploader should be able to add additional fields like description, author, type, department, job_role, date, version. permission level etc.

In both cases the uploader may decide to upload no documents, 1 document or 100 documents. There will only be a set list of allowed file types and sizes which should be checked for, the filenames themselves should be changed before uploading and MUST be stored outside public_html.

When attempting to view a file the file should only be viewable by the allowed user:

For a file for an individual employee which is public only that employee and manager and admin groups of that company should be able to view.

For a file for an individual employee which is private only manager and admin groups of that company should be able to view (i.e. employee can NOT see these files)

For policy documents - these should be viewable by all in that company in the relevant department and job role if these fields have been supplied. If not, then everyone in that company can view.

SECURITY is key - these documents contain sensitive and private information so they must ONLY be viewable by the person meant to view them and as uploads are a risk to any application they should be very safe and sanitised to stop them doing anything untoward to the server or application.