They use server side encryption to store documents on Amazon S3. This doesn't do much because the data is transparently decrypted when it's accessed (note: yes, it does require their aws account access keys).