It's stored with zero-knowledge encryption, which means the server only receives enough information to authenticate the user, but otherwise has no ability to decrypt the user's files. Proton has an explainer.