I’ve added a tutorial on Everyday Rails to show how to move Paperclip uploads out of the public directory and limit who may download them. It’s based on how I’ve done this in a few applications at work for groups who need to keep files private–hope you find it useful.