In short they hash & salt their passwords (likely salted SHA256). Additionally all data in bubble is AES encrypted at rest. Josh answers some more in depth security questions here you can read up on.