The encryption keys are on the server. We encourage you to deploy your own sharelock instance. We made that super easy with Heroku for instance (https://dashboard.heroku.com/new?template=https%3A%2F%2Fgith...). There is no storage, just a node app. And then you can configure the apps to use the sharelock instance. More about it: https://github.com/auth0/sharelock#host-your-own-sharelock-s...

Keys live on Sharelock server [1]

  Secrets are signed with HMAC SHA256 and encrypted with AES 256 CTR using keys that live on the Sharelock server

[1] https://sharelock.io/security