Only Ambrus has come close to what I see as the obvious solution to your problem. With an encrypted filesystem , even if another process can get disk access nothing will make the slightest sense. You can page encrypt RAM so that even if they break into your page they see gobbledegook. It slows the system down a bit. Maybe the best thing to do is encrypt the CC numbers at source with a public key (so it doesn't matter that the key is in plain view). The only code that can ever see the real data is the terminal process in the chain. (this assumes you do no intermediate processing on the data). BSD and a little known Tinfoil Hat linux both sport examples of encrypted fs.

As other posters have said, the issue of security is kind of subsumed into whether your server is secure. It's encouraging that you don't consider even local processes friendly, this is healthy paranoia. At the end of the day you have to store your private key somewhere, and if you cant extend your trust to that machine its no game.
Andy