Devkart is a software studio, so this page is short: what devkart.com itself collects, how what you share during an engagement is handled, and where the security pages for the two products we operate live.
A static site with one form, a chat widget and consent-gated analytics. Everything below is what its own configuration and policies say.
Submissions go to Netlify Forms, which hosts this site, and are forwarded to us by email. The form asks for your name, email, company, phone and message, carries a honeypot field against bots, and includes a consent checkbox. There are no accounts and no logins on this site.
Google Analytics loads only after you accept analytics cookies in the banner. IP anonymisation is on, Google Signals and ad personalisation are off, and declining clears the cookies a previous acceptance set. The cookie policy lists every cookie the site can write.
The Crisp chat widget loads after your first interaction with the page. Messages you send through it are stored by Crisp; its cookies are functional and are listed on the cookie policy. Block them in your browser and the rest of the site still works.
Scheduling is an external link to Cal.com, opened in a new tab. Nothing is embedded here — you enter your details on their page, under their privacy terms, only if you choose to book.
HTTPS only, with HTTP Strict Transport Security preloaded. The Content Security Policy permits scripts from this origin, Crisp and Google Tag Manager and nothing else, forbids embedding the site in a frame, and restricts form posts to this origin.
None. This site sells nothing directly and takes no payment details. Invoices for engagements are settled outside the website, under the project agreement.
The full register is on the cookie policy and the privacy policy.
A project puts repositories, credentials and business data in front of us. This is what the agreement you sign says about them, in plain language.
The binding text is the terms and conditions and your project agreement; where they differ from this summary, they win.
The scope of what this site and this studio will assert, written down so you can weigh it now rather than meet it in a procurement review.
Supaorder and SuperApp are operated on their own domains, and each publishes its own security page for procurement.
Hosting and tenant isolation, access and roles, payment handling, sub-processors, and the questionnaire answers for the restaurant ordering platform.
www.supaorder.com/securityThe same for the multi-vertical marketplace platform. Quote product security claims from these two pages, never from this one.
www.superapphq.com/securityAnswered here the way we answer them on the form, so nothing surprises you later in the process.
Certifications
Do you hold SOC 2 or ISO 27001?
No. Devkart is a software studio, and the systems we build are deployed into infrastructure the client owns, so a certification of our own office would not describe the system you end up running. For the two products we operate, the security detail is published on supaorder.com/security and superapphq.com/security.
This website
What does devkart.com collect, and where does it go?
Contact form submissions go to Netlify, which hosts the site, and are forwarded to us. Chat messages are stored by Crisp. Google Analytics runs only after you consent, with IP anonymisation on. Booking a call takes you to Cal.com. The privacy policy names each provider and what it receives.
Engagement data
How is information we share during a project handled?
As confidential information under our terms, with a separate NDA when you require one. Access is limited to the people on your project, subcontractors work under the same obligations, and access to your own systems is granted and withdrawn by you. Project material is retained for the project plus two years.
Support and availability
Is support 24/7, and is there an uptime guarantee?
Support runs business hours with responses across time zones, and the response commitments that apply to an engagement are written into its agreement. devkart.com itself publishes no uptime figure; a system we build for you runs on your platform, and its availability is a property of that platform and how it is operated.
Reporting
How do we report a security issue?
Email contact@devkart.com with enough detail to reproduce it. The same address is published in the machine-readable security.txt at devkart.com/.well-known/security.txt. We acknowledge every report, say what we intend to do, and credit you if you would like us to.
If you believe you have found a security issue in this website or in software we operate, email contact@devkart.com with enough detail to reproduce it. We will acknowledge it, tell you what we intend to do, and credit you if you would like us to. Please do not test against a client's live system — ask us and we will arrange a safe way to look.
The same contact is published in machine-readable form at /.well-known/security.txt, which names this section as the disclosure policy.
Custom software, SaaS platforms, and MVPs — engineered to scale from day one. Tell us what you're building — we'll reply within 24 hours with a clear plan and an honest estimate.
Free consultation · No upfront costs · Reply within 24 hours