Should your application necessitates your customers to enter their info on their own devices, then you qualify for SAQ A. This enables all corporations—from substantial providers to startups and smaller and medium enterprises, which may not possess the requisite security infrastructure and staff members—to remain protected and PCI DSS compliant. https://www.nathanlabsadvisory.com/blog/tag/security-awareness/