It's possible the machine has some kind of VPN connection and this encryption is indeed end-to-end, just at another layer. More probably: the branch itself has

It's possible the machine has some kind of VPN connection and this encryption is indeed end-to-end, just at another layer. More probably: the branch itself has a hardware VPN, so compromising the local network is still possible.