Yes. Files are encrypted in transit (HTTPS) and at rest (AES-256, by the storage and database providers). Nothing is public. Every request checks your login, so only you and the collaborators you have allowed can open a file.
To keep manuscripts off these servers, connect Dropbox or Google Drive. Watermarked ARC files are deleted after 30 days.
This is not end-to-end encryption. The servers have to open a file to watermark it and to send it.