I _really_ hope they let braintree handle that and don't touch PANs. If they do store PANs, presumably they'd be audited and hopefully would store them more securely. But hey, I guess you never know and less exposure is always better.