Can the site stay private?

Yes: set to “participants only”, it is visible to them alone, and a page can be stricter still than the event.

Can questions be anonymous?

Yes, and it is set per interaction: anonymous, nickname, or signed-in participant depending on what you want to get.

Yes, that is a visibility in its own right: “participants, after the event”. The file is served only then, by a signed link.

A site restricted to your teams, a programme, workshops, and the floor given to the room without anything leaking out.

Illustration - no real data

The difference from a conference is one setting: the site is not public.

Before
You set access to “participants only”: the site is then visible only to signed-in participants, and registration can be limited to addresses on your domain. Programme and workshops are built as anywhere else, and invitations go out by email.
During
Audience questions can be anonymous, which is often what it takes for them to be asked at all. Moderation lets you choose what appears, polls are chained from a phone, and room screens show what you send them.
After
Handouts and replays are published with their own visibility: everyone, participants, or participants after the event. The report stays internal.

Four modules carry most of an offsite. The resource library comes with it.

Two things an internal offsite sometimes needs and the tool does not do.

No sync with your corporate directory. Staff can sign in with their company account (SSO), but the participant list does not update from the directory.
No certified named voting. Polls are there to animate a room, not to produce minutes.

Can the site stay private?: Yes: set to “participants only”, it is visible to them alone, and a page can be stricter still than the event.
Can questions be anonymous?: Yes, and it is set per interaction: anonymous, nickname, or signed-in participant depending on what you want to get.
Can replays be released only afterwards?: Yes, that is a visibility in its own right: “participants, after the event”. The file is served only then, by a signed link.