It should be sufficient if the file resides in a directory path that is not open to browsing by the web server (ie. lies outside the webroot path) or by an ftp server. So long as the outside path has permissions set such that the webserver user account can read files in that directory, the cgi script can fetch the file and send it to the client, but the client won't be able to get at the file any other way except through the cgi script.