The bitcoins are locked on the blockchain and can only be released when both the site and the depositor sign the transaction. The depositor signs the transaction with a payment password which is not stored anywhere (we only generate a seed from it) and is created before he deposits anything.