It is if you use full-disk-encryption which is highly recommended.

so only when at rest and not while you're signed into the device?