I havent seen a whitepaper as such, but their help goes over this , they say the private keys are saved on device only https://support.google.com/duo/answer/9280240?hl=en