PCI-compliant payment processing