The ballot counting device has a locked compartment where the inserted ballots are kept. Only the inspector for the location has the key (although this may be handed to another worker when the inspector takes a break). This compartment has a numbered tamper seal placed on it, and this seal is checked throughout the day and its number is re-recorded each time.

Provisional ballots and mail-in ballots are similarly protected. They aren’t behind a locked compartment, but the boxes they go into are again sealed with tamper-evident seals that are—again—numbered and regularly checked.

Of course, no system is perfect and inspectors are undertrained (a few hours of training once every other year or so), overloaded at times, and human. As someone in security as my day job though, I’d say the measures in place to prevent tampering, fraud, and ballot disclosure are reasonably sound.

Source: I am an SF election inspector.