Menu

Individual skill

cometchat-compliance

Data governance & compliance for CometChat — pick the data-residency region, satisfy GDPR/CCPA (right-to-erasure and data export), plan message retention & purge, and produce audit / eDiscovery records. Cross-family: all server/REST/dashboard-side. Triggers: 'is cometchat GDPR compliant', 'delete a user and their data', 'right to be forgotten', 'export a user's data', 'data residency EU', 'which region', 'message retention policy', 'audit log', 'eDiscovery', 'HIPAA/SOC2 chat', 'compliance review'.

plugins/cometchat/cometchat-skills/skills/cometchat-compliance/SKILL.md

Read pinned source

Source commit d780783eba4ecc7c8b9429f95c9362df95f07c61

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,532
Repository last updated
Nov 6, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

> **Ground truth:** REST shapes are FETCHED from the live docs — `{DOCS_BASE}/rest-api/users/delete` (erasure), `/rest-api/messages`, `/rest-api/conversations` (access/export), `/articles/properties-and-constraints` (regions, retention behaviour), `/moderation/reviewed-messages` (audit). `DOCS_BASE = https://www.cometchat.com/docs`; append `.md`. Where a control is a **dashboard setting or a sales/plan item** (a managed retention policy, a signed BAA, certifications), this skill says so plainly rather than inventing an API. Certification status (SOC 2, ISO 27001, HIPAA) is a business fact — confirm current scope at `{DOCS_BASE}`/the trust page, don't assert it from here.

## Use this skill when
A privacy/security/compliance review, a data-subject request (delete/export), choosing where data lives, or planning retention and audit. All actions here are server-side; there is no client code to write.

## 1. Data residency — choose the region up front
CometChat hosts each app in one region: **`us`, `eu`, or `in`** (`{DOCS_BASE}/rest-api/chat-apis` → Data Center Hosting — re-fetch before quoting to a customer; regions can be added). The region is fixed to the app and is part of every API/SDK endpoint (`https://{APP_ID}.api-{REGION}.cometchat.io/v3`, and the SDK init `region`). To keep EU data in the EU (GDPR) or meet a residency clause, **create the app in that region** — you cannot silently move an app's region afterward; migrating regions means a new app + a data migration (`cometchat-migrate-from-*` machinery / CometChat support). For full data sovereignty (your own infrastructure), see `cometchat-self-host`.

## 2. Right to erasure (GDPR Art. 17 / CCPA delete)
Call the REST **Delete User** endpoint (`DELETE https://{APP_ID}.api-{REGION}.cometchat.io/v3/users/{uid}`; see the docs at `{DOCS_BASE}/rest-api/users`) with the **REST API Key**:
- **Default** (no body) → **deactivates** the user (recoverable; keeps data).
- **`{ "permanent": true }`** → **permanently deletes the user with all their messages, conversations and associated data. Irreversible.**

```http