I'm working on this at the moment. Currently I'm using Bitlocker on a virtual disk. I'm going to test using Keypass to unlock it soon (which in turn unlocks at

I'm working on this at the moment. Currently I'm using Bitlocker on a virtual disk. I'm going to test using Keypass to unlock it soon (which in turn unlocks at the beginning of the session with a long passphrase, but unlocks after that with Windows Hello face recognition). I've identified some potentially sensitive data could be in session logs or screenshots, so I've set up the default location for my logging and screenshot apps to be in the Bitlocker virtual disk. In the case of logs, I was already syncing them between machines using Syncthing, so I'm now syncing between encrypted volumes. I'm not syncing the screenshots, but I am also implementing encyrpted backups, so I'll probably include the screenshots folders. Meanwhile, I've realised that my scanned receipts should also be encrypted, so I'll probably use a similar sync-between-encrypted-virtual-disks process with them. Unfortunately my first virtual disk is too small and I haven't yet checked how easy it will be to expand. I'm mostly Windows, so I only really have to solve for that. Fortunately, Keepass is cross-platform (even works on my Pine Phone, along with Syncthing - same for my Android tablet, but my iPhone is trickier), so if I want to expand this to my Linux or Mac laptops it's not hard. I was trying to solve saving authenticator seeds (which is something I regred not doing up to this point) securely outside of my main password manager. That was using an obscure archiver with a password protection option. This turned out to be way to clumsy to be practical. For small stuff like that, It's going in the password manager database for now.