The Underscore Archives

> That means at the very least annual security audits and
> added expense.


Means at the very least you should be using a 2 box web server/db server setup.  Our usual advice for payment processing  generally is to see what the end users bank supports/recommends on the grounds that it's a lot easier to prove who you are and you stand a chance of haggling over charges.