The settings for each payment system is stored in an XML file. This is given a .config extension so that the file contents can not be read across the web if the exact path to the file is typed into a browser. For additional security, it is advisable to encrypt this file using the checkbox provided once your site is going live.