Most merchant account gateway providers have some sort of tokenization scheme to allow for recurring billing. The token is tied to transferring money from a specific credit card to a specific merchant account so it's not useful for 3rd parties to gain access to, unlike raw CC data.