Yes, this was my thought too. Through their API can't you essentially mimic the same functionality as if cards were stored on your servers without having to deal with PCI compliance?