Woohoo.

Being a merchant who processes online, there are many security implications you need to be aware of. Just passed Type 5 SAQ-D, which is required for anyone who actually stores data for ANY period of time, which differentiates it from a Type 4.

This is one of the most difficult to attain due to the requirements for software auditing, smart coding practices, setting up stateful firewalls, and handling of volatile data. Passed with no issues.