Ben...
- Yes you must have ssl cert. (you really should have this regardless)
- You can store exp date in aware, and manage with aware rules (exp date is ok to store)
Hendrik - yes, you're correct, I forgot we also need customer/card update, will add to spec.
Ben, Braintree doesn't suit our requirements cause of need for multicurrency, see my comments above (this may not affect you). Ok re debit card, I will confirm (I assume you mean a visa/mastercard debit card right?). And I will take pp off the spec.
Also, everyone needs to be aware, stripe pays out seven days after transaction, not next day.