Everything is hosted on relays. Escrow payments are swapped from lightning into an escrow contract onchain, and swapped back out into the lightning wallets on payout. The escrow can only forward / reverse the payment.