A DM is only visible to the sending and receiving server. It is like an email. The server admin on both sides can read them in the database. They are encrypted during the transport with tls (https). The database is usually not encrypted at rest.

You can PGP encrypt them. That should make them secure.