That's a technique that Braintree has popularized if not pioneered, but it's a neat trick that most people agree is PCI compliant (I also hope and believe this)

That's a technique that Braintree has popularized if not pioneered, but it's a neat trick that most people agree is PCI compliant (I also hope and believe this), not a change in the security standards. Among others, USAePay has also made this possible for some years (not as well as braintree does), and the payment startup stripe http://stripe.com/ http://stripe.com/ achieves the same result in a more JavaScript-y way. It is getting more popular, though, I suppose.