“Encrypted storage” reads like a single promise: even if someone walks off with the machine, the data is unreadable. The promise holds, with a condition, and the condition has nothing to do with the software. It has to do with what state the device was in.
When the encryption is doing anything
Data at rest is encrypted. On a machine that is powered down and locked, the workspace is a meaningless run of bytes on disk.
While you are working, the picture is different. If the app can read your data, the store is open, and anyone looking at that screen reads the same thing. The useful question stops being “is the data encrypted” and becomes “was the device locked at that moment”.
The manner of losing it decides the outcome
A closed laptop with the lock screen engaged and a laptop left open on a café table are not the same incident.
Closed is not the end of it either: in sleep, keys can stay in memory. Full-disk encryption (FileVault on macOS, BitLocker on Windows) and shutting down rather than sleeping are the two settings that close that window. Both belong to the operating system. An application layer cannot promise much on its own while the disk underneath it is unlocked.
Why the vault sits apart
Vault records are encrypted separately from the rest of the workspace and stay masked even in the list. The practical consequence: on a session you forgot to lock, your notes are readable, but an API key is not on screen. Opening one is a separate act.
That is the line between five minutes at an unattended screen and a week with the disk. The same measure does not cover both.
There is no remote wipe button
With sync off, there is no server that can send a command to the device. The “remote wipe” a corporate MDM performs is not available here, and that is the direct bill for the local-first decision.
There is something on the other side of the ledger. Because what you keep in the vault is replaceable by design, you still have a working revocation list: revoke the key and the copy on that device turns into a dead string.
The first hour
- Revoke every API key and token from the vault in the provider’s console and issue new ones.
- Change passwords for accounts left signed in on that device and use “sign out of all sessions”.
- If any account’s second factor lived only on that device, get in with recovery codes and move the factor.
- Trigger your operating system’s remote lock if it has one; with full-disk encryption on, that is usually enough by itself.
- Look at the date of your most recent Markdown export. The work you lost is everything after it.
Item five looks unrelated to device security, and it is usually the one on the list that hurts.