Third that. I used to work at a company that processed a high volume of payments. It's a pretty big pain to be PCI compliant, from restricting access to any server that handles payment information, to managing who can access what information. Like the parent said, unless you're doing multi-million dollar business, it's probably not worth it to handle this on your own.