In case your application requires your clients to enter their info on their own personal equipment, Then you definately qualify for SAQ A. The information defense authorities, Doing the job jointly in the European Facts Safety Board, should really ensure that the information security procedures during the EU are used https://www.nathanlabsadvisory.com/blog/tag/cyber-threats/