If you're using AEM Forms, then you have the ability to create an Adaptive Form and associated process that can pass both the form and the form data through a comprehensive workflow.
The process starts when you provide initiators with the form they need to complete to start a process. Once that form is completed and submitted, you can define the forms and form data that will be presented to subsequent users.
The "Assign Task" step that you use in the workflow allows you to select the form that will be presented to the next user in the step, the data that is embedded into that form, and the decisions they can make. For example, an initial user fills in a form indicating that they are on boarding a new employee. The initial form includes personally identifying information (PII) such as birthday, salary, and SSN. One of the steps in the on boarding process is to have this new employee added to the corporate directory. The manager responsible for this addition needs only the new employees name, address, and contact details and no PII or salary information. So, this IT manager is presented with a request to onboard the employee that includes only the information they need. Not only can the irrelevant data be omitted, they can be presented with an entirely different form than, say, the human resources manager responsible for setting up payroll.
At the data layer, the developer decides what data is inserted into each of the task assignments. This data is stored in what we typically refer to as the "runtime" layer. It is a data layer that specifically holds the data of an ongoing long-lived process. This data isn't user accessible.
Outside of the runtime layer, the developer has the option to write any elements of the workflow out to a 3rd party database whether it's MSSQL, Oracle, or other supported database. These can be used for external reporting, etc.
When using Workspace, the default application for initiating form submissions and responding to task, users have access to the forms and form data only for the steps that they are responsible for. Using the on boarding example again, the initiator can reference the initial form at any time and can see what step the process is currently at, but they cannot see the forms or form data of subsequent users. i.e.: The HR manager cannot see step details pertinent to the IT manager and vis versa.
Storage-wise, the "document" technically is not stored unless you specifically write it to a specific destination. However, each variable including document data is stored in the runtime database and includes an instance of that variable for each step the process goes through. Not user accessible data but could be programatically accessed. That said, the best practice for reporting and accessing data externally is to use your own datasource and not access runtime data directly.
As a side-note, upgrade to AEM 6.2 Forms and use Adaptive Forms as your main forms and PDF as a document of record (DOR) only.
@leesutton