Happens at the Nic to Nic level, so it is, since data is secure from your machine to the server's nic. A request is made, you get a public key that encrypts your requests and can be decrypted by the server's private key. The server sends you requests encrypted by the private key and can be decrypted by the public key you hold.