Dedicated cold storage (hardware wallet). 100%. Not even a question.
Those private keys should not be on an internet connected device and certainly not kept on an exchange.