It’s stored in the secure enclave locally on the device. They said it can’t be fooled by photographs and they tested it with “Hollywood mask makers”. It’s “one in a million”.