[Question] How do CeXes store Private Keys?

Hey guys, I am doing some research and I'm wondering how do CeXes secure the custodial wallets' private keys?

For example: let's say I'm building a CeX. I need to generate an address from a seed for each user and save that address and its seed (or PPK) somewhere so I can forward tokens from those addresses as users deposit in them, meaning I will need the seed phrase. Or if the funds stay in those wallets, I need the seedphrase for when they want to withdraw.

What is the best way to secure these seeds or PPKs? Any reading material or suggestions you might have is very much appreciated.