So do you need to send your actual coins to be involved in the masternodes, or are they kept in your own private address?

Just interested from a security perspective.