As a general rule, no one at the company can discover, see, or access users' direct conversations, private activities or deal activities unless they are invited. These medians are as private as sending an email.
The only exception is that company or team admins can add themselves onto Canpays. This cannot be done in secret so a user would notice if they add themselves to their Canpays. This is necessary to support users and reassign work, and maintain company control of the information held in important deals when people leave. If your Canpay is private and no business partners are yet invited, then no one can see it exists until a business partner is added.
Companies can assign permissions to see Canpay Briefs by tags like division, department, category, geography, etc. None of these permissions allow those users to gain access to the contents exchanged in the activity unless a person is expressly invited into something.
Candex stores all files and messages and though they are controlled by you, these belong to your organization. At any time, an authorized representative of your company can obtain full data exports of any activity (as with most email accounts). This data is in a raw format and is typically used for exceptional circumstances like legal, compliance or regulatory matters.