The credit card information is 3DES Encrypted in the database.

As long as someone doesn't have "Administrator" role on your portal, they cannot see the credit card information (This has been discussed, having a couple of other "Roles", one for order review only without credit card information, and one that allows credit card information without administrative status.... I know it has been discussed.)

ANY web site that is going to be taking credit cards should have a security certificate (SSL).