Site Factory supports the use of private files with its hosted websites.

From the File module overview page on Drupal.org, unlike public files (which can be directly accessed and downloaded if their URLs are known), private files are not directly accessible through the web server. Instead of accessing private files using URLs, links require the use of Drupal path requests. For example, a private file could be accessible at /system/files/name-of-the-file.pdf, but in this case /system/files/ is not an actual folder, but is instead a virtual URL managed by Drupal.

The private files directory for newly-created websites is set to the following directory outside of the docroot directory:

/mnt/files/[sitegroup].[env]/sites/g/files-private/[database name]

If you need to use private files, having your website’s modules or content types use files from or write files to this directory will ensure that the files will be included whenever the website is duplicated or backed up.