As long as they're salted hashes, they could be stored anywhere right?

Unless you're doing something exceedingly simple, you don't just have hashes, you have things like tokens, keys and authorization rules too.