[Paul_Heery]

If at any point the data in motion is unencrypted and clear, then it is not compliant. But, are you sure that is the case? I've seen workarounds where things like http traffic are directed through a tunnel.