Can someone summarize the basic network configuration for a helium lorawan hotspot and basic overlay / underlay or network topology?

Can someone summarize the basic network configuration for a helium lorawan hotspot and basic overlay / underlay or network topology?

For instance, is the Lora traffic encrypted over the internet using ipsec? What kind of access security is used? Is there any kind of ACL required? Etc