It's a combination of a bunch of database tables. The credentials themselves are in tsycredentials (encrypted obviously), and they link to different scanning targets with their own specific database tables like tsysIpRangeCredentials and tsysDomainCredentials.
If you take a look at all the tables in the database, it shouldn't be too difficult to find how it fits together.