Our payment gateway is Stripe. All card numbers are encrypted at rest with AES-256. Decryption keys are stored on separate machines. Stripe use HSTS to ensure that browsers interact with Stripe only over HTTPS