Subtoshi runs off of a cold and hot wallet setup. Most of the coins are stored in cold wallets, where they cannot be withdrawn. A small portion of the coins is stored in hot wallets, where they can be withdrawn. The hot wallets are manually refilled by myself. Also, as an added note, when a withdrawal fails, it probably means the hot wallet is empty (although I try to prevent this).
As far as web security, all traffic is automatically analyzed for suspicious activity. There is a lot more going on in the background to maintain the security of the site itself. All the best practices of database management and data storage are followed. Passwords are salted and hashed, code is tested extensively by myself to make sure there are no security holes. I also have a very strict password strength policy for anything that is password protected (such as private keys, database data, etc.).