What are the top three things I should check during a commerce platform security audit to ensure customer credit card details are fully encrypted?