It is Bitlocker'd, plus EFS'd (just in case my TPM gives up the keys - it's unclear if the password is mixed in to derive key material or not). And I'm getting a new SSD with "Encrypted Drive" support, so the keys are never in-memory (although again, I don't know if the key is just sitting in an easily-accessible chip on the disk, or if my password combines for key material).

And then EFS on top of that, and each VM has its own encryption as well. So even a full compromise won't hurt the VMs I'm not using at the time.

But it doesn't help since OneNote's online slick-access-from-anywhere, doesn't do crypto AFAIK. So all my transparent crypto protect my local device, but OneLook uploads the notebooks unencrypted to SkyDrive.