If there was a PCI audit, that CI system would fall inside the audit's scope and thus held to the same rules as the app server.