Yup. While it is possible to blast everything to public relays, the better option is to put an application relay behind a firewall or into its own segregated network, accessible by the app only. This is way stronger than having everything in a password-protected database that stores everything in the clear and is only one admin password away from total breach.