Does this suffer from the same problem as VPNs, where a valid subpoena can force the companies hand to subvert connection to the safing servers from a specific IP address?
Your user/pass is never sent to the network servers, but only to the account server, which gives you blind-signed access tokens, so the servers of the network only knows that you are allowed to access, but not who you are.
I e.g. really like blocking apps that should not need to connect connect to the internet in the first place.