If an attacker somehow downloaded all my databases (because we keep data partitioned to minimize damage if one of them is compromised, as well as to better part

If an attacker somehow downloaded all my databases (because we keep data partitioned to minimize damage if one of them is compromised, as well as to better partition the application itself), then they would be able to see all of history. But they wouldn't have the user's credit card, because that's encrypted separately with the key stored somewhere else. And they wouldn't be able to take action on behalf of the user. That is, they couldn't place new orders as the user, or stuff like that.