The data directory:

    - contains both permanent and temporary application data

    - must be writable by the web server

    - must not reside in the web server's document root