The application outputs no clear-text account data outside the POI device; truncated PANs keep to the digits PCI DSS allows, and where a legal obligation requires full PAN on receipts the application transmits the clear-text PAN only to the printing function and securely deletes it, with the obligation documented under Domains 1 and 3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.