I'm pretty sure that it's only in the cloud if you let it. LastPass encrypts everything locally and there is an option to disable syncing with their servers. That being said, I may end up also enabling the multifactor authentication they have, just to be safe.