In trying to set up my payment gateway tonight so I can begin accepting credit card orders on my web site, I learned that while you are required to collect every customer’s CVV2 number (the three-digit one on the back of the card), it is illegal to store it in any way for any length of time. I verified this right here on page 12 of Visa’s Merchant Rules document.