Private keys for secret chats are only stored on the two participating devices.

As for server code — open sourcing the server code wouldn't really do much to improve trust. You would still have to trust us that we are using THAT code, not something different.