By default Backup Client will save your backups into a directory named "backup_client" inside your Drupal files directory. If you are using the public download method (check here) then anyone can download your backups. But, the public can only download your backups if they know the name (ie. path) of the backup file. To keep them from guessing multiple strategies are configured by default. Additionally, the access permissions on the create backup files are also limited by default. If this is not good enough then you can also store your files outside your web root. But, it make it harder to download them.

Options with security implications: