Path said it was sending over HTTPS, but storing in plaintext - protected by a firewall. No server-side encryption.