Credit card numbers should not be kept on file as a general practice. Limited exceptions apply such as if you need to bill the customer on a frequent and recurring basis (at least monthly) and explicit permission is obtained from the customer. The credit card number must be filed in a secure location, in a safe or under lock and key. Credit card numbers must not be stored electronically, i.e. in a spreadsheet, database, or anywhere on a computer and/or network. Once the customer relationship is finished, the credit card number should be cross-shredded. It is a good practice to have customers keeping their credit card number on file with the University to sign an authorization form at least annually to confirm their intent to keep their credit card on file.