I wrote this as a reply on a post by @skreza, and thought its worth posting here :)
Have a read!
Bitshares is a blockchain whose main coin is BTS, but it has the ability to support thousands of other coins/tokens. When you make an account on Bitshares, your password is linked to your private key. So whatever coins you have on Bitshares, are ONLY with you, ONLY the person with your password can spend those coins. The coins are on the blockchain, and Bitshares.org is ONLY a block explorer (like blockchain.info for Bitcoin).
So using Bitshares.org will only display information from the blockchain. But to spend your money or send it, you need your password. When you want to do a transaction, your password is used on your own machine to create a signed transaction which is then sent to the server. So your coins are as safe as your password or the computer you save your password on.
Also, there is no "They", because there is no one who owns the exchange. The orders get posted in the blockchain and when someone wants to buy/sell your order, the transaction happens automatically.
As for OPEN assets, they are not completely decentralized. OpenLedger is a 3rd party company that has issued tokens on the Bitshares exchange, e.g. OPEN.BTC. They did this so users can exchange Bitcoin (Ethereum etc) on Bitshares. But Bitcoin cannot be brought on another blockchain, so how they did this was, they said if you send them BTC, they will give you OPEN.BTC. i.e. 1:1 IOU. You can use this OPEN.BTC on the bitshares exchange, and when you want, you can withdraw it, and then you will get your real BTC back. So in case of OPEN assets, you need to trust OpenLedger company that they will return your money when you want to withdraw it.