We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the PDF contains a 40 byte unique string specific to this communication to ensure uniqueness and to avoid guessing.
Is there any best practice concerning this approach, may the PDF-files be placed on the webserver directly, or should additional steps be taken in order to prevent harvesting or any other attack on our customers privacy?
Would there be an additional security gain in storing the PDF's in a database, instead of placing them directly on the file-system of the webserver (assuming it is properly secured)?