Credit card numbers should not be kept on file as a general practice. Limited exceptions apply such as if you need to bill the customer on a frequent and recurring basis (at least monthly) and explicit permission is obtained from the customer. The credit card number must be filed in a secure location, in a safe or under lock and key. Credit card numbers must not be stored electronically, i.e. in a spreadsheet, database, or anywhere on a computer and/or network. Once the customer relationship is finished, the credit card number should be cross-shredded.