In Drupal 7, I have the file system configured as

In the code for the Webforms' file component located at sites/all/modules/webform/components/file.inc, it appears that one could easily change it so that Webform file uploads are moved to the private file system by changing 'scheme' => 'public' to 'scheme' => 'private'. But I also know the pitfalls of hacking (changing) anything that could easily be overwritten with drush upc.
/** * Implements _webform_defaults_component(). */ function _webform_defaults_file() { return array( 'name' => '', 'form_key' => NULL, 'required' => 0, 'pid' => 0, 'weight' => 0, 'extra' => array( 'filtering' => array( 'types' => array('gif', 'jpg', 'png'), 'addextensions' => '', 'size' => '2 MB', ), 'scheme' => 'public', 'directory' => '', 'progress_indicator' => 'throbber', 'title_display' => 0, 'description' => '', 'attributes' => array(), 'private' => FALSE, 'analysis' => FALSE, ), ); } Given that all file uploads are stored referenced in the file_managed table
mysql> describe file_managed; +-----------+---------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +-----------+---------------------+------+-----+---------+----------------+ | fid | int(10) unsigned | NO | PRI | NULL | auto_increment | | uid | int(10) unsigned | NO | MUL | 0 | | | filename | varchar(255) | NO | | | | | uri | varchar(255) | NO | UNI | | | | filemime | varchar(255) | NO | | | | | filesize | bigint(20) unsigned | NO | | 0 | | | status | tinyint(4) | NO | MUL | 0 | | | timestamp | int(10) unsigned | NO | MUL | 0 | | +-----------+---------------------+------+-----+---------+----------------+ Is it feasible to do a post operation to a file upload that manually moves a file from public:// to private:// and updates the database entry? Would hook_file_presave or hook_file_insert be good tools to accomplish this?
Update
Based on the suggestion of using hook_webform_component_info_alter(), I implemented the following
/** * Implements hook_webform_component_info_alter(). */ function MYMOD_webform_component_info_alter(&$components) { $components['file']['extra']['scheme'] = 'private'; dsm($components['file']); } /** * Implements hook_file_insert(). */ function MYMOD_file_insert($file) { dsm($file); } After the output of the DSM() shows the component array seems to be altered but the DSM from hook_file_insert() still shows that the file was deposited into the public area:

$components['file']['extra']['private'] = TRUE;and no luck. The file upload still gets throw into sites/default/files/webform/upload.drush cc all && drush cron). It now appears in the Field's settings!! Mind moving your comment down into the answer? drupal.org/node/1201084#comment-9490409