Hey Mark,
They're always routed through Retool to manage access permissions, and ensure sensitive API keys and other credentials aren't leaked to the browser :-).
You can read more here:
https://docs.retool.com/docs/security#data-storage-and-security
Jonathan