Mint's 2010 VP of Engineering answers this question on Quora: http://www.quora.com/How-do-mint-com-and-similar-websites-av...

Apparently, it's stored encrypted but will be decrypted on-the-fly when Mint needs to refresh your banking data.

Edit: Here's the patent he referred to that handles the decryption: http://patft.uspto.gov/netacgi/nph-Parser?Sect2=PTO1&Sect2=H...