Secure locatoin for encryption Key and IV value

I am developing a site to be hosted on the public domain. One of the classes is responsible for performing encryption. The class uses built-in .NET AES classes to perform encryption. It relies on a Key and IV value for encryption. Currently these values are stored in the class itself. My questions are:
Is the class itself a good place to keep the values. What if I place the values in web.config file. I read somewhere that to keep the values protected, its better to create a seperate WCF Service which will keep the values plus perform the needed encryption. Is this a better option? And if so, since the application will be hosted on the a remote server, should I create a ClassLibrary project for the WCF Service (so that the DLL is included in the website itself) or have it hosted as a seperate application all together. Thanks in advance