Check out PCI DSS regulations for storing credit card numbers, they're pretty strict.