You should look up what is recommended by the PCI DSS (<a href="http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard" rel="nofollow">http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...</a> / <a href="https://www.pcisecuritystandards.org/" rel="nofollow">https://www.pcisecuritystandards.org/</a>).