You are only allowed to collect credit card data if you have a direct relationship with the acquiring bank. Abuse of this policy from the card associations would most likely get your business terminated and black listed.
Third party processors are required to pass an audit each year that helps ensure that the safety of data collected is secure and handled properly.
That being said, you also have a good point. Epoch offers features that allow you to cross sell or up sell to your customers without them having to re-enter their card data. Everthing is handled in a secure environment by Epoch. If you'd like to know more, drop us a line.
[email protected]