MULTISITE PRIVACY PLUGIN is not stopping direct file access

MULTISITE PRIVACY PLUGIN is not stopping direct file access by non-logged in user.
The plugin seems to work fine, if non-logged in users access a web-page. But any direct links to ANY files in the website seems to go through, without authentication.
We have some PDFs that have sensitive information, within the protected website.
Any tips, tricks would be much appreciated.