Where to store sensitive uploaded file?

Upload files at anywhere ( normally create your own folder inside wp-content/uploads folder ), you can create .htaccess file and index.html files inside the folder to restrict the files from direct access.

Keep index.html blank and add deny from all text in .htaccess file.