Correct place for _editable_ app config files ?

This seemingly simple question actually applies to any application server. The problem is, simply put, where should I put my _editable_ configuration files for best maintainability. That is, properties, or even some segments of Spring context files that contain runtime environment information. Is it

1) under WEB-INF in the jar => the jar is extracted under webapps
The files will then, of course, be overwritten by the next deployment
OR
2) deploy them separately in the tomcat-level conf directory
3) something else ?

Is there a "recommended" best practice on how to do runtime configs on modern app servers?

The case: After a year of running an app in production, I was deploying a new package on a Tomcat hosted by a third party. During that time, the service provider had changed the DB url and uid/pwd in the exploded webapp directory, without notifying anybody.

Spring developers habitually configure everything in the *context.xml files, including DB connection parameters, so that's what was edited in the webapps directory by the ISP. So, when I deployed the new app version, the valid DB connection params were overwritten by the configs that had been written according to the latest knowledge of the runtime environment. Fortunately, I had taken a backup of the webapps directory so I was able to trace and replicate the changes.

To sum it up, it seems a bit dodgy to me to assume that the ISP could directly edit the stuff in the exploded webapps directory... Did I get this all wrong, or do you see my point ? Of course, this has a lot to do with the ISP:s process of app maintenance, too...