Machines can sync directly in most cases (especially on the LAN, and even over the Internet). If, for some reason, communication cannot be established directly between machines, a relay server is used, but the traffic is encrypted end-to-end between the devices, so the relay server cannot decrypt it or MITM it.

Take a look here[1] for the security spec

[1] https://www.aerofs.com/security/spec