It should be on a location that can be reached from your webserver. Be sure to encrypt it!