It's stored client-side, and as a back up on the central server, with a passphrase that is the users responsibility.
And there's the rub. "What do you mean, I can't ever see my data again? Why can't you reset my password?"
We know that true security means only the user has the key. But users don't all want that responsibility.