How can I secure a custom module that contains sensitive data?
As long nobody is able to read this php files, there's no problem. If your host is set-up correctly and you are using the standard .htaccess file which comes with core, you should be fine.

An other question is who has access to your host and your source code. A good practice is to avoid any sensitive data inside git or any other source control system. A way to do this is to have a local.settings.php file a longside your settings.php. You can include it in your settings.php by ading this code at the end of the file:

if (file_exists(dirname(__FILE__) . '/local.settings.php')) {
  include(dirname(__FILE__) . '/local.settings.php');
}


Make sure this local.setings.php file is never visible to unauthorized people.

You can set any system variable in local.settings.php to your needs.