diff --git a/doc/sshproxy-dumpd.txt b/doc/sshproxy-dumpd.txt
index b9f87822..dbaf4406 100644
--- a/doc/sshproxy-dumpd.txt
+++ b/doc/sshproxy-dumpd.txt
@@ -24,6 +24,10 @@ named after the user. The filename is the concatenation of the start time and
 a unique session identifier calculated with some of the header information
 (it is the same one used by *sshproxy*(8) in its log).
 
+Warning: sshproxy-dumpd expects an unencrypted data-stream. If you want to
+encrypt it, you first need to create an encrypted tunnel (with ssh, vpn…), and
+send the data through it.
+
 OPTIONS
 -------
 
diff --git a/doc/sshproxy.yaml.txt b/doc/sshproxy.yaml.txt
index fe8f0e78..57e74e1d 100644
--- a/doc/sshproxy.yaml.txt
+++ b/doc/sshproxy.yaml.txt
@@ -76,6 +76,9 @@ It can also be "etcd", in order to store stats into etcd.
 
 It can also be a network address where to send dumps if specified as
 'TCP:host:port' (the TCP is case sensitive), e.g.  'TCP:collector:5555'.
+Warning: sshproxy dumps are sent unencrypted. If you want to encrypt them, you
+first need to create an encrypted tunnel (with ssh, vpn…), and send the dumps
+through it.
 
 *dump_limit_size*::
 	an integer specifying the maximum amount of bytes of a dump. Setting