It uses envelope encryption with one-time password (OTP) authentication. I like to store data on the systems I own and just run backups regularly.