This is in the Alby browser extension, client side. So Alby itself won't have your nsec key. You can sign nostr events by the browser extension.

You can check this by their free open source code. https://github.com/getAlby/lightning-browser-extension