By default Phoenix uses client side sessions. The session data is written into a cookie and signed (or encrypted) to prevent tampering.