To use Team O'clock behind a firewall you need to whitelist the service's IP addresses. However, Team O'clock is using  dynamic ip addresses, hosted in the us-east-1 AWS region. 

Although not recommended, you can still whitelist the entire AWS US East Region using the following IP prefixes from the AWS IP Ranges documentation: