Yes they do. I investigated them too, but sadly we also violate their terms and conditions.
Seriously though, our competitors seem to do it themselves. Which probably means PCI compliance and a merchant account, then doing all the integration themselves.