Inside /upload/ folder.. but their names are encrypted for futher security among other reasons. In order to find out which file is which, you need to check the tables project_files and also project_file_revisions (or similar).
Best regards,
Francisco