Went through the docs and that would be correct. The expectation is that you allow only a static IP to access it though. They provide the static IP