The escrow, not the website, holds the assets.
The development program uses Solana program-owned accounts and derived escrow authorities. SOL and classic SPL tokens have separate transfer paths. The website prepares instructions; your wallet authorizes them.