Where does the app run, and what can it reach?
Out of Office Assistant is an Atlassian Forge app, so it runs on Atlassian's infrastructure.
Where it has to reach a service outside Atlassian, such as a connected calendar, chat workspace or timesheet, it goes through Customer Managed Egress, which means a single egress URL is allowed when the app is installed.
Related pages
Privacy and Security - where this is covered in full.
Security and Privacy - more questions on this topic.