The combination of the username+password generates the private key in Zelcore. Nothing is stored on servers. If you combine a very strong user name and password, I'm no expert but it's seems it pretty secure, at least untill quantum computers appear. In the near future an additional layer of security will be added called Zel ID that will be a decentralized form of 2FA.