In the strictest sense, Access is probably not adequate by itself to conform to typical security standards for protecting data such as credit card numbers.
Your problem is two-fold.
First, you need to put the critical database on a server that has full-blown security abilities set up. Such as WinNT or Win2K. Not familiar with XP, but I've heard it stands for eXtremely Poor.
Next, absolutely make sure you don't let your users see the database window. This means a startup switchboard form and workgroup security. You also need to set up your forms so that unauthorized users won't be able to get into them. There is a lot of work that needs to be done for this to be true.
Then, if this is a shared database, it needs to be behind a corporate firewall with some pretty good rules and a better reputation than Access or Windows for its security abilities.
This is just the tip of the iceberg. Myself, I would NEVER use Access for sensitive personal data such as credit cards. I might switch to something like SQL server or (better) ORACLE server and an ODBC operation.
