A retail company stores customer credit card numbers to enable recurring subscription billing. Auditors require that the actual card numbers not be present in the company's transaction database, yet the billing system must still be able to reference the same card for repeat charges without a customer re-entering it. Which data protection method best meets these requirements?