Yes we use a temp folder. It's particularly important as the download may take some time as our clients are mobile and wireless (3G). Once the files are downloaded you can hash them again and compare that to the values generated on the server to ensure valid downloads. We also use a master hash, which is a hash of the individual hashes concatenated.