[larrysalibra]

If they're storing credit cards they're doing something wrong.

[viraptor]

Don't you need to keep the card number for processing refunds?

[steveklabnik]

Nope. You just save a token for that transaction, and tell your processor you'd like to refund that transaction. They have the associated card on file, not you.