Data is stored on the blockchain, in custom json transactions.
But as anyone can submit custom json as they like, that needs to be validated (is the sender really in possession of what he's claiming to send). Validation is happening centrally at steem engine. If they stopped working it would not be clear who can validate, as there is no consensus mechanism. From that moment the tokens are unusable. There are different options what could happen then
RE: Why steem engine is not a replacement for SMT