Yep, they're not decrypting HTTPS, I've triple checked. But we do have an MDM forced proxy service that does check any non-encrypted traffic...