You can follow the options provided in the answers in the following question, to get the PDF: Worklight Adapter getting pdf file from rest service
And the couple the above with encrypting and storing it using JSONStore.
This way I believe the data is both encrypted as well as not available to other apps.