Once the mediation server has connected the two clients together, it is not part of the communication. Therefore not tracking any data the flows.Right, but the mediation server stores your authentication details and creates SPIs for your tunnel. Those details are enough for somebody else to spoof your connection. The resulting tunnel is still technically secure except that the person using it is not you. If you can access/transfer sensitive data via the connection, so can they. This is actually true of any VPN - if you get the authentication details, you can create a connection- but usually those details aren't stored on an external server over which you have no control.
The security 'sysop' gave me the green light.Then that's fine. The above risk is theoretical and probably doesn't matter in 99% of cases. The other 1% includes medical/banking/other facilities whose data is useful to competitors or divorce lawyers.
"... They ne'er cared for us
yet: suffer us to famish, and their store-houses
crammed with grain; make edicts for usury, to
support usurers; repeal daily any wholesome act
established against the rich, and provide more
piercing statutes daily, to chain up and restrain
the poor. If the wars eat us not up, they will; and
there's all the love they bear us."
-- Shakespeare: Coriolanus, Act 1, scene 1
