Card Accounts can be used as a funding source. Card Accounts are associated with Users.
When creating a Card Account, a token is returned. You need to store the :id (and not the credit card account details) against the user on your platform. When using a Card Account as a funding source, the :id is passed to the make_payment Item Action.
There are PCI requirements for protecting Credit Card Account data.