I assume you mean you are using the blockchain.info API, which means you will be keeping "btc" on the site. You will have the keys which is the same to having access to your bitcoins.
Not controlling the keys for an exchange requires a unique architecture which would likely involve multi-sig transactions or some sort of intermediary/escrow service (which would still have some control over keys).
Learn as much as you can about cold storage. Use that for a majority of your keys. Only keep on site enough to pay out in a timely fashion unless you can have a trusted staff member who is in control of moving keys from cold storage throughout the day.
Cold storage. Cold storage. Cold storage. I cannot stress that enough.