Location of Sitecore data folder and App_Data

Sitecore recommends moving the data folder outside of the webroot because of security issues. This is normally a good idea, as the datafolder contains information, which shouldn’t be accessible for end users. However you might as well use .NET’s security applied to the App_data folder.

Jens Mikkelsen: Consider using the App_data folder as your Sitecore data folder