How to create a custom field for a file upload, and make it private
CiviCRM files are never directly web-accessible. If you are also using Webform integration to submit the file, then a copy of the file is also stored in Drupal. You could either make your Drupal files private (this is a Drupal setting) or you could implement a hook to delete the files from Drupal after they are uploaded.