Some payment gateways offer "gateway recurring billing" where the credit card data is stored at the gateway not on your most likely less secure servers. Ashley Madison could have done that and avoided some of the damage from the breach.