Lobstr wallet security

Question

I am checking the best Stellar wallet to save my assets. I have setup the account on LOBSTR. I'm interested most in the security.

Looks like the transaction is not signed on client but on server side. They already explained with me:

That's the main point of the LOBSTR wallet security - we don't have access to our users' money.

The encryption/decryption of secret keys happens on the fly, and among other things involves the password of a user, which again is not stored on our end in plain text.

But when I make a withdraw, I saw only these data sent to server. No transaction was built. Does it mean that server will build transaction and load the secret key of user to sign the transaction?

Anyone could help to explain this? Thank in advance.

{ csrfmiddlewaretoken: "3ZeHfJxIIXyoxX6jIsysSoyrquyAT1nJomFauVs1gDKl4Bjnvc64YkexsfFJ93Rg",…}
    csrfmiddlewaretoken: "3ZeHfJxIIXyoxX6jIsysSoyrquyAT1nJomFauVs1gDKl4Bjnvc64YkexsfFJ93Rg"
    send_type: "wallet"
    destination: "...ESUUS...."
    phone_number: ""
    email_address: ""
    amount: "0.0001"
    asset_code: "XLM"
    asset_issuer: null
    no_memo: "on"
    otp: "612499" }