Passwords are encrypted in a way that even I can't access them, and are stored along with all other data (except uploaded images) outside the container (see my reply to Dan).
There is a daily backup to a remote server with a different provider 5 countries away.