Are the passwords protected or encrypted?

The password to each site is encrypted before it’s written to the config file, then decrypted and passed to the Lync / SfB client as clear text in an API call. If you’re concerned for the security of your passwords,

Where are the sites / profiles stored?

The sites and profiles can usually be found in an XML file called “user.config” in your user profile: e.g. C:\Users\<Username>\AppData\Local\bounSky.com\bounSky_2015.exe_Url_\13.0.4.33\