Comment by Traubenfuchs

We are using self developed application layer security. It requires specialized client code and is terminated at a gateway that proxies requests to our normal applications.

I really, really hate the idea of this kind of eavesdropping.