Im leaning twords the PGP encrpytion but the annoyance of having to manually do the recurring billing may not make it fly with the boss.

Yes, and when the credit card numbers get stolen, and you lose all of your existing customers, and get bad publicity to keep away all new ones, and the business shuts down, *that's* annoying. This is one area where it should be fairly easy to explain to the PHB that the price of security is definitely worth the cost. (three-machine, encrypted, at the least).