If you are using the self hosted version, the email and password hash are stored in your db (the one you have connected supertokens core with). If on the other hand, you are using our managed service version, it gets stored in a dedicated database we provide for your instance of the core.