Spreedly is storing data [ http://blog.spreedly.com/2010/2/10/three-new-gateways ]. Others may only be transmitting, but I think PCI applies even if data is only transmitted?