The DDX does not necessarily have to be installed on your server (it could be).  If you choose to install it on a PC or other server (i.e. away from your ticketing server) this is fine so long as the DDX can connect (via connection string) to the ticketing database.

If you are concerned about security, there are additional security measures that you can take including:

• Creating a specific SQL Server user and enter the credentials into the DDX under SQL Server authentication.
• Limit access of this user to the tables that are being called – the user permissions could be ‘datareader’

There is more information about configuring your DDX here