Yes, consider using a company that 1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial

Yes, consider using a company that 1. technologically competent (PCI compliant and more) 2. That company can keep that information along with other financial data. 3. That vendor's code and hardware infrastructure is being periodically audited by a third (independent ) party and expert. Or open sourced! Both hardware and software. 3 is crucial to maintain the operating integrity of the company.