No. Wrong. See my discussion of setgid/setuid programs a few sections below.

You don't have to set your code to 0700 to make it secure. Make the data 0060 and make your setgid code do a thorough authentication before it reads the data file.

You don't have to worry about the group being compromised, because you don't even need to have any members in this group. No one can read the data except your program. If you build sufficent security into the program, you're all set.

(This time I remembered to log in...)

buckaduck