Amazon Location Service vs Nominatim

Amazon Location Service 87

The Smithy service models for geo-places, geo-routes, geo-maps and location (API version 2020-11-19) are public in aws/api-models-aws and in every AWS SDK, a machine-readable contract in the role OpenAPI plays (25). llms.txt for the developer guide, a Markdown twin of each page and the whole guide as full.md (10). A choose-an-API page and per-operation pages with use cases say when each call fits, with less on when not to use one (15 of 20). Inputs carry enums and ranges, such as MaxResults 1 to 100 and QueryText up to 200 characters (15). How-to pages give sample requests, responses, cURL and CLI commands, and each action lists its errors with HTTP codes, but the ValidationException fields are documented as "Test stub" (12 of 15). Versioned paths (/v2/), yet the document history, re-read on 1 November, still has one entry, dated 31 October 2024, and changes are announced only in AWS What's New posts (10 of 15).

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Amazon Location Service 30

No x402, MPP or L402 (0). Per-1,000 prices for every operation and bucket published without a login, in the price feed the pricing page loads (still the 11 September 2026 publication on 1 November) (20). The pricing page lists monthly allowances for the first three months (20,000 core Places calls, 10,000 routes, 500,000 tiles), and Free Tier FAQ Q4, re-read on 1 November, says a payment method isn't required to sign up for most new customers but may be requested to verify identity. Half the line, as amazon-s3, amazon-polly and aws-secrets-manager got for the same FAQ (10). A person signs up in a browser. CreateKey mints API keys by API only after an account exists (0). 0 + 20 + 10 + 0 = 30.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Amazon Location Service 76

Three credential routes, SigV4 with IAM, Amazon Cognito, and API keys limited to named actions and resources with optional expiry and referrer or app restrictions, which earns 30 (the API key page re-read on 1 November). Less 10 because the API key is sent in the key query parameter, the only documented way to present it (20). API keys reach only read calls on Maps, Places and Routes, and IAM policies scope each action and resource (18 of 20). Results carry place names and third-party map data, and no prompt-injection guidance was found in the reviewed documentation (5 of 15). CloudTrail records management events by default and data events on request, and CloudWatch reports usage by ApiKeyName (15). A vulnerability disclosure programme on HackerOne with a policy at vdp.aws.security, public security bulletins (none from 17 October to 1 November names Amazon Location), audit reports in AWS Artifact, Amazon Location Service in SOC 1, 2 and 3 scope on the list updated 11 August 2026 (per the 17 October check), and a FedRAMP High announcement of 28 October 2024. The aws.amazon.com security.txt, re-read on 1 November, expires on 16 October 2027. No paid bug bounty was found, so 2 points stay held back, as on the S3, SES, Polly and Secrets Manager re-checks of 17 October and the S3 re-check of 1 November (18 of 20). 20 + 18 + 5 + 15 + 18 = 76.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Amazon Location Service 77

Closed service under the AWS Service Terms (last updated 30 October 2026, re-read on 1 November), whose section 82 sets out storage, caching and attribution rules in detail (15 of 30). The guide says device positions are kept 30 days, geofences until deleted, and that queries are stripped of customer metadata before they go to data providers (per the 8 October check). Section 82.1 agrees and adds that providers may process requests outside the chosen region. No retention period was found for Places and Routes requests (20 of 30). Section 82.3 still allows AWS to change or drop a provider or feature on notice "where practicable", and no dated deprecation notice or end date for the v1 APIs was found (5 of 20). AWS's sub-processor page, re-read on 1 November (last updated 30 October 2026), lists Esri for Amazon Location in Australia, Germany and the USA and Grabtaxi Holdings and HERE North America in Ireland, Japan, Singapore and the USA, says processing happens in the customer's selected Regions and the providers' locations, and promises 30 days' notice of a new sub-processor. The region is chosen per request (20 of 20, as for S3, SES and Secrets Manager). 15 + 20 + 5 + 20 = 60.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

Amazon Location Service 95

Hosted reading. AWS Health Dashboard with a feed per service and region (20). The Amazon Location feeds for us-east-1 and eu-west-1 held no events on 1 November 2026 (last built 31 October), and the dashboard's event history, re-read on 1 November, names Amazon Location in no event. Its oldest event is the us-east-1 one of 28 October 2025, the open Middle East events of March 2026 don't list it, and the newest update is the API Gateway us-west-2 event of 30 October 2026. The public dashboard lists only broad events, so a clean feed says less than a small vendor's detailed page (30). Default rates published per operation, re-read on 1 November, 100 a second for each Places call, 20 for CalculateRoutes, isolines and SnapToRoads, 5 for CalculateRouteMatrix and OptimizeWaypoints, with a burst of 80 per cent (the burst rule per the 8 October check) (15). Throttling returns ThrottlingException with HTTP 429, marked retryable in the service model, and every v2 call is a read, but the guide gives no backoff or Retry-After guidance (10 of 15). Amazon Location SLA at 99.9 per cent monthly uptime per region (last updated 5 May 2022, re-read on 1 November) (10). GA (10). 20 + 30 + 15 + 10 + 10 + 10 = 95.

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

Amazon Location Service 88

API reading of the checklist. Places responses stay at the core fields unless AdditionalFeatures asks for more, and MaxResults caps the count, but there is no field selection and route responses can reach the 6 MB limit (20 of 25). MaxResults on six of seven Places calls, NextToken on SearchText and SearchNearby, and filters by country, bounding box and place type (18 of 20). Four typed errors per API, with a reason and field list on ValidationException (17 of 20). Every v2 operation is marked read-only in the model, so retries are safe. No hints apply to a plain API (18 of 20). One required field or none on most calls, an API key that avoids SigV4 signing, and SDKs on npm and PyPI among others (15).

Nominatim 75

API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.