I think this is absolutely true, but my understanding is that the PCI powers-that-be are OK with it. If the credit card numbers are by design not hitting your server, you don't need an audit. Yet another reason why we've avoided doing PCI stuff.

These forms sure are pretty though.