You should never save credit card information, client or server, unless you are PCI compliant. PCI stands for Payment Card Industry. You can view their website here. The standard of which we are all held to when handling credit cards is the Payment Card Industry Data Security Standard (PCI DSS).
You can get around having to be PCI compliant if you use a 3rd party, who is PCI compliant, to handle all your credit card processing and storing. I have used CyberSource and it ended up being a rather neat solution:
I just created an iframe whose source was set to a page on my network that was just a credit card form. When submitted, instead of posting to my network, it posted to CyberSource. When CyberSource processed the submission, it returned back to a specific page within my network that handled the result to update the user. In doing it this way, the credit card data never entered my network and thus I was PCI compliant.
Just as a side note for client-side, use the
autocomplete="off" attribute on all sensitive fields.
Edit per your update
Since you have now stated the site you are working on is PCI compliant, the question then changes to a multi-part question of should you:
- Inform your users via a message prior to them signing up for the subscription?
- Give your users the option of having their info saved or auto-filled?
- Not tell the users anything based on the implication of what a subscription is by definition?
My experience has been such that #2 is what a lot of users prefer. I've come across many cases where parents or friends have used their credit cards to help someone out and don't exactly want their information retained where it could be used again by that someone.
Now, in a subscription, reoccurring payments are implied and from that, saving card information is implied, either by the website or the processor. That might be where you would probably be best off at least doing #1 to inform the user what you are going to do with their information.