Where should I safely store non-served private files (invoices, sqlite db file etc.)? I dont want to serve that files. These are not static files(not img js)

I know using wwwroot is a bad idea in this case.

I don’t want to buy any cloud storage (azure etc.)

Will using any directory out of wwwroot solve my problem? Example: Path.Combine(IHostingEnvironment.ContentRootPath, “private_files”)? Is that right approach?

If i use wwwroot folder for storing private files and path of the file is known, anyone can access the private files.