The better option, for most places, is to use some form of tokenization where your CC processor stores the CC numbers and hands you an opaque token to store. M

The better option, for most places, is to use some form of tokenization where your CC processor stores the CC numbers and hands you an opaque token to store. Much less to worry about on your end as the tokens have no meaning outside the tokenization service. Also, just to reïterate the point: When it comes to security, and you're not a crypto or security person, don't be creative and don't be fancy. Use what works.