Yes. Users form an encrypted HTTPS connection between them, using credentials that are unique to the account or shared folder in which data is being transferred. These credentials are issued by Dropbox, and only given to users that have legitimate access to the account or shared folder. The credentials are rotated on a regular basis, including in instances where someone is removed from the shared folder.