tptacek has this right. Also, to clarify an all too common misconception, if you TAKE credit cards on your site, you STILL need to be PCI compliant, even if yo

tptacek has this right. Also, to clarify an all too common misconception, if you TAKE credit cards on your site, you STILL need to be PCI compliant, even if you don't STORE credit card numbers. Not storing them gets you out of a few requirements, but you still have to be compliant with most of them.