Also in flowing�s invoice system for the consulting services we also do :D
All over https and never saving credit cards info (only the gateway�s token of the authorised cards, the sensible data only touches RAM and gets a nice nil on the instVar after the gateway's result)
We could authorise and capture on debit cards too but the gateway we�re using has debit only for brazilian cards and doesn�t provide the international debit feature (which seems to be kind of a big deal for vendors and banks)
Let me know if you want to extend its API to your gateway, just push the merge requests.
Here... this is how our invoice system looks: