The key is stored in the Agilicus credentials service as an encrypted audit-destination secret, protected by strict role-based access control.