4. We have an environment that is in scope for PCI DSS. Is app.pulumi.com PCI DSS compliant? It stores our infrastructure state which might include sensitive information like access tokens, passwords etc.

I'll have to follow-up on this one. Note that we also have an on-prem installer option as part of our Enterprise offering that is in private-preview right now that would allow you to host the service yourself.