By default, Session uses the Session File Server for attachment sending and storage. The Session File Server is an open-source file server run by the Session Technology Foundation. When you send an attachment, the file is symmetrically encrypted on the device and then sent to the Session File Server.
The current 10MB file transfer limit is due to limitations with the onion request protocol. While privacy-preserving, onion requests are unable to support the transfer of large files. Session's developers are currently investigating methods to enable larger attachment sizes for Session Pro users in the future.