They implement robust data security measures to ensure the app is PCI-DSS and GDPR compliant. They follow compliance best practices, including robust encryption, access controls, regular vulnerability assessments, data minimization practices, and clear user consent mechanisms. They have a dedicated team that maintains a robust governance structure and even provides timely training to their developers on regulatory requirements.