In our software, permissions are never copied via SSH. Only via direct disk-to-disk copying or via afp on the LAN. So you would need a VPN if you have to copy over the Internet.
The reason is that the main use for stuff like SSH or FTP in our software is online backup, where the source and destination are usually completely different computer systems (such as Windows and Linux) and permissions therefore cannot usually be retained.