It is recommended that you upload subtemplates to the BI Publisher catalog.
The catalog is the most secure location.
For compatibility with older versions of BI Publisher, it is also possible to call a subtemplate that resides in a file on the local server, or on a different server (that can be accessed by HTTP protocol). Using one of these methods requires specific import syntax and server settings to allow the communication. See Calling a Subtemplate from an External Source for more information.