Only the posting key, so your funds are perfectly safe. The posting key is stored on a server which only has SSH private key access and no login access, which means for anyone to access it they must have the actual key file. All is safe, we also have SSL on the web frontend.