Commerce Reference Store extends the credit-card item descriptor so that the credit card number is encrypted using the Triple DES encryption algorithm from the Sun JCE security provider. Out of the box, Commerce doesn’t apply any encryption to credit card information.