On Google Cloud (Firestore and Cloud Run) in the EU region. Secrets are stored server-only and access is enforced by security rules that deny all direct client reads.
Still have questions?