Security advises

recomandations are the same for hosted instances.
If you can, set directories out of web reach as described on config page and reminded on global configuration page. It is what we do on our hosted instances for our customers.
It is the only way to be sure nobody can have access to these files outside the application.
But application is secured so that it may ne quite difficult to write in the log file even if it is kept in degault location.

outside public_html which is your web home directory (DocumentRoot in Apache)