You have a controlled environment for the workers, who do their work on locked down software and hardware. Basically, employees don't get to bring any personal possessions into the room where they do the work, the software through which they do the work does not allow them to copy or export any data, the OS that hosts the software doesn't allow them to do anything but run the software.