When Business Connectivity Services need to access external data which requires per-user authentication, it uses Secure Store Service to store the user password in order to avoid asking for it again and again.
Since the external data source needs the password itself, and not its hash, it means that Secure Store Service records the password itself, probably not in plain text, but still in a way it can be decrypted.
Every MSDN article (such as this one) I've read about Secure Store Service explains the benefits of using it, but not the internal workings.
How are passwords actually stored? If encryption is used, how is the decryption key stored?
In other words, are passwords safe if, for instance, a malicious person obtains an exact copy of the hard disk of a server hosting Secure Store Service? What if at instant t, the person has access to both the hard disk and the memory?