Files uploaded to your forms are assigned a very complex URL. Only people having this URL can download these files. However if you want increased security for your file uploads, you can restrict access. For example, to be able to download these files requires you to be logged in to your Jform account within the same browser. You can read more about this feature.