Hello Nick,
You are right. Personal data is stored by Password Manager in a data storage directory. You can read more about that in the "Data Storage Security" section of the Password Manager guide.
This directory by default is located under the user's personal directory on the file system:
"%APPDATA%\Roaming\SAP\signon\Softtoken"
If the directory is changed by the system administrator prio installation of Password Manager, you need to know where it is located for the user who forgot their master password and security question and answer.
In either case, you can delete this directory and start Password Manager again to create a new master password and security question and answer for the user.
Best regards,
Lyubomir Lalev