The multisig is all handled in the backend without you having to handle private keys directly.
BitGo stores your private keys too, presumably in an encrypted form which is protected by your password so they can't access the private keys. When you login, your wallet is loaded in your browser locally and it contains one set of your private keys. When you make a transaction, it is made in your browser and signed in your browser using the private keys that were loaded. This transaction is then sent off to BitGo who also signs the transaction, presumably after you use 2FA to authenticate the send. Then it is broadcast to the network.
The third set of private keys are ones that only you have. You should have downloaded those (along with the set that BitGo has in your encrypted wallet) when you created your wallet. That set of keys also lets you create transactions without BitGo being involved.