Unless you know exactly what you're doing - and if you're asking this question, you don't - don't store credit card numbers at all. There is no justifiable advantage to doing this when Braintree/Authorize.net/etc provide much more secure ways to make arbitrary charges against a card.