PCI scope

If an app is in PCI scope, it needs to draw a diagram for audit. An app is in PCI scope when it processes or transfer payment data. An example would be a textfield for getting credit card numbers. An app with such textfield is in PCI scope.

Putting UI in PCI scope will create a lot of more work, so one solution is to use a an iframe from the backend (which is already in PCI scope) to process payment information.