Well, aside from the fact that it's calling out to the internet, the service is in early access. Using cert-manager at and a self-signed cert, you can set this up in a fenced environment as well.