By default Backup Client will save your backups into a directory named "backup_client" inside your Drupal files directory. If you are using the public download method (check here) then anyone can download your backups. But, the public can only download your backups if they know the name (ie. path) of the backup file. To keep them from guessing multiple strategies are configured by default. Additionally, the access permissions on the create backup files are also limited by default. If this is not good enough then you can also store your files outside your web root. But, it make it harder to download them.
Options with security implications:
This sets the path to where your backups will be saved. By default it is set to a directory named "backup_client" within your Drupal files directory. If you would like to save your files outside of your Drupal install you can use a path like this: ../backup_client. If this path is not web accessible then you'll enjoy more security with your backups. But, you will not be able to easily download them via a web browser.
Please be careful when changing the token patterns. You will want to ensure that each file has a unique name. This can be accomplished by adding date info, random characters, and/or sequential numbers. Additionally, if you do not sufficiently randomize your backup filenames, and your files are web accessible (ie. in the files directory), a malicious person could guess the name and download your website backup.
Why is this a problem? Within your website backup is your settings.php file and within this are the username and password to your database. For more information about security please view the Security help page.
Please be careful when changing the token patterns. You will want to ensure that each file has a unique name. This can be accomplished by adding date info, random characters, and/or sequential numbers. Additionally, if you do not sufficiently randomize your backup filenames, and your files are web accessible (ie. in the files directory), a malicious person could guess the name and download your database backup.
In shared hosting environments and/or when multiple users have access to the server you want to limit access only. This option sets the permissions on each backup file to only be read and written by the user who created it. This will be the user Apache (or PHP) is running as. Note: your account may not be this user and therefore you will have difficulty reading and writing these files. See the FAQ page for tips.