By default, a hosted layer is private when it is first published and is only accessible to the publisher and the administrator. It is not available to others; for example, it does not appear in search results and isn't part of any group. To make a hosted layer available to other users, the layer owner or an administrator must explicitly share the layer.
ArcGIS Online secures all access to your information. User identity is established when the user signs in, which always takes place over an encrypted connection (HTTPS). Subsequent transactions require the token acquired at sign in and can take place over encrypted or unencrypted connections.
For more information about Esri's commitment to security and compliance, visit Trust ArcGIS.