Currently User password are stored in MD5, but we are in the process of moving this to SHA256 with Salted hash.This is to strengten Encryption.
​
We have a procedure for constructing the encryption keys that does not requires them to be saved anywhere.