[defrost]

> Is it reasonable to grant such privilege access to a [ company ] that ultimately is a black box ?

This is common enough in the corporate world and precedence in similar circumstances will come into play in various lawsuits.

Examples:

XYZ Security Guards: a third party physical security provider that hires people to watch and patrol buildings, assets, with access to keys, timetables, security logs, etc.

ABC Armoured Transport: third party physical transport provider for cash, sensitive documents, etc.

When AcmeCorp Inc. hire XYZ & ABC it's on the basis of reputation, contracts, and things generally not to do with peeking inside how the cake is baked (hiring records, etc).