How we're licensed, how we audit, how we keep regulators sane
Every regulatory claim on this site — Hero kicker, /pricing badge, Footer pill, /decision trust strip — is verifiable on this page. If you spot a discrepancy, email the compliance address below.
HK SFC Type 4 (Advising on Securities) — in preparation
Concordal intends to operate as a licensed entity under HK SFC. Current state: (1) HK OpCo 'TradingAgents (HK) Ltd.' incorporation in progress (Vistra-assisted); (2) Responsible Officer (RO) + HK office address under confirmation; (3) Type 4 application targeted within 60 days of OpCo registration.
Until license grant, Concordal provides a decision-support tool only — not investment advice. All marketing copy referring to 'licensed' is qualified with 'in preparation'. Every decision result includes a red disclaimer banner.
What data, how long, who sees it
| Data type | Retention | Visibility |
|---|---|---|
| Decision trace (LLM calls, tokens, reasoning) | Indefinite (audit requirement) | Owner + regulator (subpoena) |
| Email (magic-link auth) | 30 days after account deletion | Stripe + email provider only |
| Payment data (Stripe) | Per Stripe (≥ 7 years) | We never store card numbers; Stripe-side only |
| Decision share links (shareId) | Until user revokes | Public to anyone with the link |
| Reflection memory (system learning) | Indefinite; user-clearable | Owner's future decisions only |
| Server logs (IP, user-agent) | 90 days | Render + Vercel ops only |
Every LLM call leaves an immutable trace
For every decision, the system records:
- Per-agent LLM model, exact call time, input/output token count, dollar cost
- Raw timestamps from every data source (SEC EDGAR / Reddit / akshare / EastMoney)
- Final recommendation + confidence + risk flags (BUY / HOLD / SELL)
- If dual-LLM consensus is enabled, the second model's independent verdict + agreement score
- Full trace is shareable via public link (user-authorized) or kept private (default)
Live / scaffolded / planned
Right person, right inbox
Inboxes are monitored by the compliance lead under RO supervision. Every email gets a first response within 72 hours. Regulatory complaints are automatically copied to external legal counsel.