Generally, the public keys are generated from a public generator and the private keys are generated from the corresponding private generator, stored on a highly-secure machine. No communication is permitted to the machine holding the private generator.
You do have to know that Bitcoin keys can be generated by generators. The public generator generates a series of public keys and addresses while the corresponding private generator generates the corresponding series of private keys. There is no way to determine the private generator given the public generator.
The flow goes like this:
A new public address is needed.
The next public address is assigned, using the public generator.
The machine holding the private generator is already watching every payment and will detect any payment to a key generatable from its private generator.
When a deposit is made, the private generator machine detects the deposit and issues a transaction to transfer the funds to an appropriate hot or cold wallet. (Or waits until the hot wallet is low, or whatever it's programmed to do.)
The regular machine also notices the deposit (because it knows the public keys) and credits the user.
The math is (oversimplified!):
Private generator: P (a random 256-bit number)
Public generator: GxP (P times the generator constant, an EC point)
Account ID: I (an incrementing number)
Account public key: GxHash(I) + GxP (EC point)
Account private key: P+Hash(I) (256-bit number)
This works because Gx(P + Hash(i)) = GxHash(I) + GxP
So the account private key is the private key corresponding to the account public key. The account public key can be generated from the account ID and the public generator. The account private key can be generated from the account ID and the private generator. No private keys can be generated without the private generator.