Group Homepages are PUBLIC by default.

Any visitor to the site can see anything you post on your group homepage.

Do not set your group homepage to private! Group Homepages must be public in order for the group to show up as an option on the registration page. It is possible to make your homepage private, but then the group administrator will have to add all new members manually, which can be confusing for your group members and extra work for the group administrator.

Whenever you create a new page, it is public by default. To make it private, change the "Group content visibility" field to "Private." Then only logged-in members of your group will be able to see it.

Pages and other content you create in Drupal are delivered from the database and can be password-protected. Documents and files, on the other hand, are stored in folders on the server, and these folders cannot be password-protected under the current setup.

You can hide your files from the public by making sure that the only links to the files appear on password-protected pages. If people can't access the page with the link, then they won't know how to get to the file.

However, you should be aware that if the URL to the file is somehow published, the file will be accessible to anyone who finds that URL.