This is how every payment provider/processor I've ever worked with works, going back more than a decade. In fact Stripe and Braintree (and I'm sure others) hav

This is how every payment provider/processor I've ever worked with works, going back more than a decade. In fact Stripe and Braintree (and I'm sure others) have systems where the implementing service doesn't get the credit card number at all- the payment information is sent directly to the processor from the client and the implementing service only gets a vault token.