Its in the ATSAM, the data sheet says:
16 Kbytes ROM with embedded bootloader routines (UART, USB) and IAP routines
also
The SAM-BA Boot is in ROM and is mapped in Flash at address 0x0 when GPNVM bit 1 is set
to 0.
So when the bit is set it must be over writable just like a normal ISP/similar