Custom Binding Message Secuity

Question

I'm reviewing an applications WCF security, and one of the bindings is a custom binding to achieve compression. The other bindings are standard wshttpBindings using message level encryption using a server certificate.

Custom binding

<customBinding>
    <binding name="Elements.Foundation.CustomHttpCompression">
      <security authenticationMode ="SspiNegotiated" />
      <foundationMessageEncoding innerMessageEncoding="textMessageEncoding" />
      <httpTransport hostNameComparisonMode="StrongWildcard"
          manualAddressing="False"
          maxReceivedMessageSize="10000000"
          authenticationScheme="Anonymous"
          bypassProxyOnLocal="False"
          realm=""
          useDefaultWebProxy="True" />
    </binding>
    <binding name="customMex">
      <textMessageEncoding>
        <readerQuotas maxDepth="2147483647"
        maxStringContentLength="2147483647"
        maxArrayLength="2147483647"
        maxBytesPerRead="2147483647"
        maxNameTableCharCount="2147483647" />
      </textMessageEncoding>
      <httpTransport transferMode="Buffered"
          maxReceivedMessageSize="2147483647"
          maxBufferSize="2147483647"/>
    </binding>
  </customBinding>

Standrad Binding

<wsHttpBinding>
    <binding name="Elements.Foundation.FileTransferServicesBinding"
     maxReceivedMessageSize="1048576" messageEncoding="Mtom" >
      <readerQuotas maxArrayLength="1048576"
         maxBytesPerRead="1048576"
         maxNameTableCharCount="1048576"
         maxStringContentLength="1048576"/>
      <security mode="Message">
        <message clientCredentialType="UserName" negotiateServiceCredential="true"
       establishSecurityContext="false" />
      </security>
    </binding>

During my testing I traced the activity on both the non compressed and compressed (wshttpBinding and custom) binding and both seem to be have in the same results, at the transport layer they both used encrypted data (e.CypherData) in the envelope parameters for transferring the data. The compressed and non compressed endpoints exist on the same service(s).

I can’t explain why the compressed (custom binding) looks to be using message level encryption can you? Is it a by product of it running on one machine, will this still be the case when I move the code onto a production server and connect via the internet?