IT hands HR a box the rest of the company can't read

IT creates a container on the company's own bare metal server, tags it into an HR realm, and hands the team a workspace URL: files, a SQLite database, a browser panel. Tokens scoped to the HR realm can't enumerate engineering's containers, and engineering's tokens can't list HR's. The proxy serving the URL runs on the server in the company's own rack.

What the SaaS vendor could read, nobody outside HR can now. Hoody's API sees that a container exists; it doesn't see what's in the exit interviews.

HR's files are on the company's metal, behind a wall the company's own admins can't read through.