What we hold
Two categories, kept separate. Account data is what identifies your organisation: names, work email addresses, billing contacts, tax registration and payment references. Platform data is what your workloads produce: container images, datasets you upload, model checkpoints, logs and inference traffic.
Account data is retained for as long as the account is open and for seven years afterwards, which is what Nepali company and tax law requires of us. Platform data is yours, and is deleted on request or within 30 days of account closure.
Where it lives
Both categories are stored in np-ktm-1, in Kathmandu. Neither is replicated outside Nepal. We do not operate a foreign disaster-recovery region, because a DR region abroad would defeat the reason customers choose this platform.
- Object storage and block volumes are encrypted at rest with AES-256.
- Traffic to and from the control plane is TLS 1.3 only.
- Tenant networks are default-deny between customers, enforced by Cilium.
Who can read your data
Nobody at CoreValley reads the contents of your volumes, notebooks or inference requests as a matter of course. Engineers can access a tenant's storage only through a break-glass procedure that requires a named approver, is time-boxed, and writes an entry to the append-only audit log you can export.
We do not sell data, and we do not use customer workloads or prompts to train anything.
Third parties
Payment processing is handled by eSewa, Khalti or your bank, depending on the method you choose; those providers see the transaction, not your workloads. Identity is handled by Keycloak, which we host ourselves in the same region. Product analytics are first-party and aggregate — we do not embed third-party tracking scripts on the portal.
The contact form on this website is delivered by FormSubmit (formsubmit.co), a third-party form service with servers outside Nepal. It carries what you type into the form — your name, work email, organisation and message — to our inbox, and nothing from your account or your workloads. Keep confidential details out of the form; we will set up a secure channel for them.
Your requests
Write to privacy@corevalley.ai to get a copy of what we hold on your organisation, to correct it, or to have platform data deleted. We answer within 30 days, usually much sooner.