Nice post, very useful. One comment - it will be a good design to include some process within the application code around the payment card data to detect/monitor/alert in case some external code/process is accessing it.