[arch-choot]

I'm pretty sure the default is they can see all the cleartext, since their product is based on TLS interception, for example to evaluate page rules.

This is also how they insert extra headers in both the request and response.