yep you're right. It totally makes sense to mask cc data any gateway processor should adhere to that internal control...but to have an audit trail of who made the changes, that's something that the system should have.