We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This information is entered and transmitted from browser to our server through non-SSL connection. Other PCI-DSS rules (such as password restrictions) are also not satisfied by the site. Then this billling information is transmitted from our webserver to Authorize.NET's servers. CC number isn't stored by ourselves but we store (in not encrypted way) CC expiration date, 4 last digits of CC number, first and last name of cardholder. When user purchases something at 2nd time, he should just choose to use this existing credit card to buy something.
API Login ID and Transaction Key are also stored in not encrypted way.
Is our site PCI compliant? Is it a correct way of using CIM?
Edit: Will it be enough to just switch to site-wide SSL and not store CC expiration date and 4 last digits of CC number?