We basically created a CPT "Downloads" and each post has a file uploaded to it through the file_upload metabox field. This file needs to be uploaded to /wp-content/uploads/secure/ and not /wp-content/uploads/[year]/[month]/ like the rest of time images and files that can be publicly available.