Have a little question regarding api key security - how are the keys secured (guess this applies to both this service and exchanges)?

Iam guessing they aren't encrypted client side, so technically someone could wreak havoc with my coins if they hack your servers?