By default, a hosted layer is private when it is first published and is only accessible to the publisher and the administrator. It is not available to others; for example, it does not appear in search results and isn't part of any group. To make a hosted layer available to other users, the layer owner or an administrator must explicitly share the layer.
ArcGIS Online secures all access to your information. User identity is established when the user signs in, which always takes place over an encrypted connection (HTTPS). Subsequent transactions require the token acquired at sign in and can take place over encrypted or unencrypted connections.
The organization administrator determines whether HTTPS is required for all transactions. See Configure security settings for information on how to turn on HTTPS for your organization. The all-HTTPS solution supports maximum security and ensures that all data (for example, features and tiles), as well as authentication tokens, are encrypted during transport over the Internet. HTTPS is enabled by default for organizations.
For more information about Esri's commitment to security and compliance, visit Trust ArcGIS.