The clean room is a container with one door

Two companies want to know how many customers they share. Neither will hand the other its customer list, and the clean-room products that broker this sit on a third party's cloud.

Build the room instead. One container on rented metal: both parties' datasets mount read-only into it, its network is blocked at the host where nothing inside can undo it, and the only way out is a single pre-agreed pipe that carries the aggregate result: a count, not a list. Both sides can inspect the analysis code before the door opens, because the room's whole configuration fits on a page.

When the answer has left through the pipe, delete the container. The meeting place stops existing.

Two companies' data met in a room neither can empty.