Save your files to the /WEB-INF folder or anywhere to your hard drive (except deployment directory of course)
I used this piece of code (it stores files for each user into it's own folder)
String path = Util.getPathToFiles() + "WEB-INF" + File.separator + "upload";
    try {
        path += File.separator + session.getCurrentUser().getLogin();
        if (!isFolderExists(path)) {
            new File(path).mkdir();
        }
        path += File.separator + file.getName();
        FileUtils.copyFile(file, new File(path));
    } catch (IOException ex) {
        Logger.getLogger(ThesisBean.class.getName()).log(Level.SEVERE, null, ex);
    } finally {
        file.delete();
    }
getPathToFilessimply returns the realPath from ServletContext and FileUtils is class from Apache IO (but you can write your code for file copy on your own, it's just helper class)