[adamlj]

If you have to store CC data inhouse I would suggest storing it on a completly sepatate machine which only stores and charges cards. The only communication allowed from this box would then be Store this card, Charge the card with this token etc.

[stevekemp]

I wrote a similar comment too. In practice you find you might want to allow "delete card" or "update card" which are complications to the simple-model.