All files are handled by http server. All files has to be RW by http server, and all directories has to be RWX by http server. That's all. It depends on your server / who is the owner of files, etc.
More secure setting is to allow write only for data directory (and files, dirs inside recursively), however EPESI store needs to write in the modules directory also.
Regards,
Adam
