All the history is stored in Mongo. I am considering adding some kind of message timeout however to keep the mongo database small.

Also, with regards to password protected groups, I do have plans to add private groups for projects and github repositories etc. Groups that require invites and the like. This is mainly just a proof of concept for the others on the developer team to be able to see.