The WPI doesn't seem to allow configuration of directories outside the webroot, so I've configured acls via manifest.xml and web.config to prevent access to the files, however this won't work with IIS 6, need to check to see if we can make IIS 7.0 a dependency or hack the parameters.xml script to generate a directory outside webroot.