I got my tapsigner and some satscards last week. I've only set it up single-sig on a small amount on my phone. Haven't done any backups yet.

My understanding is that as long as the password is secure, you can store the backup wherever. Unless someone has physical access to your tapsigner, which has the decryption password printed on it. See the "Evil Maid" section here.