[objectivefs]

For laptops it might be easier to avoid storing any of your sensitive data to disk.

Use a non-local encrypted filesystem per project to get the isolation and to avoid your local storage. Mount the project filesystem when needed, unmount it when done, and when not in use it is simply inaccessible to the laptop.

While any encrypted filesystem not stored on your laptop would work for this, ours[1] makes this workflow very easy.

[1] https://objectivefs.com