Cards on file, and how card data is handled

A customer record can carry a card for repeat business, so a dealer who ships every week is not re-reading a card number down the phone each time.

What is actually stored

A token issued by your payment processor, plus the brand, the last four digits and the expiry — enough to show "Visa ending 4242" and to charge against, and nothing else. The token is encrypted at rest and is useless to anybody who is not your processor.

That is not only a privacy preference — it is what keeps MegaHub, and by extension your brokerage's use of it, in the lightest PCI category. A system that handled raw card numbers would pull everyone using it into a far heavier compliance regime.

Tokens belong to one processor

A token is issued by the gateway that created it and cannot be charged anywhere else. If you move from one processor to another, cards saved under the old one stop being chargeable and have to be re-entered by the customer. Your old processor can sometimes migrate tokens for you — ask them before you switch, not after.