Ground truth: REST shapes are FETCHED from the live docs — {DOCS_BASE}/rest-api/users/delete (erasure), /rest-api/messages, /rest-api/conversations (access/export), /articles/properties-and-constraints (regions, retention behaviour), /moderation/reviewed-messages (audit). DOCS_BASE = https://www.cometchat.com/docs; append .md. Where a control is a dashboard setting or a sales/plan item (a managed retention policy, a signed BAA, certifications), this skill says so plainly rather than inventing an API. Certification status (SOC 2, ISO 27001, HIPAA) is a business fact — confirm current scope at {DOCS_BASE}/the trust page, don't assert it from here.

Use this skill when

A privacy/security/compliance review, a data-subject request (delete/export), choosing where data lives, or planning retention and audit. All actions here are server-side; there is no client code to write.

1. Data residency — choose the region up front

CometChat hosts each app in one region: us, eu, or in ({DOCS_BASE}/rest-api/chat-apis → Data Center Hosting — re-fetch before quoting to a customer; regions can be added). The region is fixed to the app and is part of every API/SDK endpoint (https://{APP_ID}.api-{REGION}.cometchat.io/v3, and the SDK init region). To keep EU data in the EU (GDPR) or meet a residency clause, create the app in that region — you cannot silently move an app's region afterward; migrating regions means a new app + a data migration (cometchat-migrate-from-* machinery / CometChat support). For full data sovereignty (your own infrastructure), see cometchat-self-host.

2. Right to erasure (GDPR Art. 17 / CCPA delete)

Call the REST Delete User endpoint (DELETE https://{APP_ID}.api-{REGION}.cometchat.io/v3/users/{uid}; see the docs at {DOCS_BASE}/rest-api/users) with the REST API Key:

Default (no body) → deactivates the user (recoverable; keeps data).
{ "permanent": true } → permanently deletes the user with all their messages, conversations and associated data. Irreversible.

DELETE https://{APP_ID}.api-{REGION}.cometchat.io/v3/users/{uid}
apikey: {REST_API_KEY}
content-type: application/json

cometchat-compliance

Use this skill when

1. Data residency — choose the region up front

2. Right to erasure (GDPR Art. 17 / CCPA delete)