The data is stored on the device's Secure Enclave chip and is available only there. It's encrypted, and the data "never leaves the device," according to Apple. Even Apple doesn't receive the data, and it's not stored when your phone backs up, either.

"Face ID data doesn't leave your device, and is never backed up to iCloud or anywhere else," Apple writes.

It's the same way data is stored for Touch ID, Apple's fingerprint reader. Because the data is stored on your device and not on a server or in a cloud, someone would have to have physical access to the device to be able to steal it. And even that would be difficult, considering that the Face ID data is encrypted.