You can store the files outside of the document root, and include them on the backend with a relative path.
Web server will deny access to the parent directory of docroot, but the backend services will be able to access them.