Agree. I think if the solution is auditable you’re OK. Many companies take first party accountability for capturing recurring credit card consent from customers and store the “proof” as an auto able document.