I've switched the check to js and I no longer pass the card data to the server at all. Thanks for the concern; got me to fix it.