By default, a hosted layer is private when it is first published and is only accessible to the publisher and the administrator. It is not available to others; for example, it does not appear in search results and isn't part of any group. To make a hosted layer available to other users, the layer owner or an administrator must explicitly share the layer.
ArcGIS Online secures all access to your information. User identity is established when the user signs in, which always takes place over an encrypted connection (HTTPS). Subsequent transactions use an authorization token and also always occur securely over HTTPS.
For more information about Esri's commitment to security and compliance, visit Trust ArcGIS.