The SIMPLEST way to do this is to charge their credit card with a
recurring charge when they sign up, and then just THROW AWAY their credit
card number.
Your credit card processing vendor then has to remember their credit card
number, not you.
I agree. This is the way I've worked for years, and it has always worked perfectly. Not once have I ever had all 16 digits of a customer's credit card. I can't even get it from my provider (first 4 and last 4 only).
Authorize when they order, store the transaction ID, settle the transaction by ID later in the future if the order goes through.