By default the Vintasoft API 2 controller works with files from "[WebApplicationRootPath]/UploadedImageFiles" folder and stores cache in "[WebApplicationRootPath]/VintasoftCache" folder. By default files in both folders "UploadedImageFiles" and "VintasoftCache" can be accessed by web client because folders are located in the root folder of web application. If you do not want to provide access to folders "UploadedImageFiles" and "VintasoftCache", you need to override behaviour of Vintasoft API 2 controller and create custom data storages.

Version of VintaSoft ASP.NET MVC Annotation Demo project, which uses "UploadedImageFiles" and "VintasoftCache" folders outside of web application folder ("D:\1\"), can be downloaded here: https://www.vintasoft.com/files/SourceCodes/AspNetMvcAnnotationDemo_cacheOutsideAppFolder.zip.