You're on Linode and consider yourselves to be PCI compliant? Even though you're not storing the cards yourselves (probably using tokenization on Braintree or Authorize.net) you need to be compliant as the cards pass through your servers.