A method for selectively performing man in the middle decryption by data processing apparatus, the method comprising: receiving, by a gateway (102, 202) on a network (100, 200) from a client device (106, 212, 214) within the network, a Hypertext Transfer Protocol request addressed to a first resource on a server outside the network; determining, by the gateway, a class of network traffic of which the received Hypertext Transfer Protocol request is a member, the determining being based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic for each class; selecting, by the gateway, a man-in-the-middle gateway within the network from a plurality of available man-in-the-middle gateways (204, 206, 208, 210) within the network, wherein each available man-in-the- middle gateway is associated with a class of network traffic and wherein the selected man in the selected middle gateway is selected based on having a class that is the same as the determined class of the Hypertext Transfer Protocol request; sending, from the gateway to the client device, a message redirecting the Hypertext Transfer Protocol request to the selected man-in-the-middle-gateway within the network; establishing (310/312, 314/316) a first encrypted connection between the client device and the selected man-in- the-middle-gateway, and a second encrypted connection between the selected man-in-the-middle-gateway and the server; retrieving, by the selected man-in-the-middle-gateway, the first resource from the server; modifying the first resource to change pointers within the first resource to point to location in a domain associated with the selected man-in-the-middle-gateway within the network; and serving, by the selected man-in-the-middle-gateway to the client device, the modified first resource. receiving, by a gateway (102, 202) on a network (100, 200) from a client device (106, 212, 214) within the network, a Hypertext Transfer Protocol request addressed to a first resource on a server outside the network; determining, by the gateway, a class of network traffic of which the received Hypertext Transfer Protocol request is a member, the determining being based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic for each class; selecting, by the gateway, a man-in-the-middle gateway within the network from a plurality of available man-in-the-middle gateways (204, 206, 208, 210) within the network, wherein each available man-in-the- middle gateway is associated with a class of network traffic and wherein the selected man in the selected middle gateway is selected based on having a class that is the same as the determined class of the Hypertext Transfer Protocol request; sending, from the gateway to the client device, a message redirecting the Hypertext Transfer Protocol request to the selected man-in-the-middle-gateway within the network; establishing (310/312, 314/316) a first encrypted connection between the client device and the selected man-in- the-middle-gateway, and a second encrypted connection between the selected man-in-the-middle-gateway and the server; retrieving, by the selected man-in-the-middle-gateway, the first resource from the server; modifying the first resource to change pointers within the first resource to point to location in a domain associated with the selected man-in-the-middle-gateway within the network; and serving, by the selected man-in-the-middle-gateway to the client device, the modified first resource.