IM is not considered secure and should not be used to exchange confidential information.   It is not necessarily encrypted, and the information passes through the IM provider's server where it's stored.  IM was designed to be fast and easy, not secure.