that sounds like the most secure way, .. not storing a key anywhere, but this would require manual processing everyday which i'm not too hot on.
currently i don't store cc#'s myself, and the bank has a recurring billing manager, but it leaves much to be desired in the way of features.
after a lot of research, i do have an automated method in mind which should be as secure as i can get it without having to manually process everyday. it's just that talking about it in any detail in public will be a hole in the first line of defense
