By default, ASP.NET Core session data is stored in-memory within the same process as your application. However, this is not suitable for production scenarios, especially if you're running your application in a distributed environment or if you need to handle large volumes of data.