Amazon Textract vs Docling

Amazon Textract 58

The Textract API model last changed on 11 August 2026, a documentation update, 82 days before the re-check, and the JavaScript SDK client shipped 3.1161.0 on 30 October (20 of 30). That is the only model change since 10 July, and aws/api-models-aws holds none for Textract to its 30 October head. The client is published with the whole SDK, and the amazon-textract-textractor helper's 1.10.0 (11 August) is a helper release that doesn't change the service. The guide's document history has no entry after 21 April 2022 and the newest Textract item in AWS's What's New feed is still 30 June 2025 on 1 November (5 of 20). The 11 August model change leaves the 90-day window on 9 November. Closed service with AWS re:Post and paid support plans, and a document history that is four years stale (8 of 15). Official SDKs released on most working days (15). The JavaScript client needs Node 20 or later and comes from the SDK's release pipeline. The amazon-textract-textractor helper library released 1.10.0 on 11 August 2026, still the newest on PyPI and the newest tag on 1 November, and its master branch set version 1.10.1 on 23 October without a tag (10).

Docling 89

v2.148.0 on 5 November 2026, the day before this check (30). 13 releases from 9 October to 5 November (20). Open issues and pull requests are numerous, an AI triage workflow and PR reminders run, and six maintainers are named; replies not sampled (17 of 25). docling-mcp publishes to the official MCP registry on release under io.github.docling-project, per its workflow and server.json; the registry entry itself was not read (12 of 15). CI, a dependency-update workflow and uv.lock (10). 30+20+17+12+10 = 89.

Amazon Textract 35

No x402, MPP or L402 (0). Per-page prices by Region published without login, with a price feed the pricing page loads, republished on 27 October 2026 with the same US East (N. Virginia) page prices (20). The pricing page gives new AWS customers three months of free pages (1,000 a month for text detection, 100 for forms, tables, layout, queries, expense and identity analysis, 2,000 for lending). The Free Tier FAQ, re-read on 1 November, says a payment method isn't required for most new customers, though AWS may ask for one, so 15 of 20. A person signs up for the AWS account. IAM can mint keys by API only after that (0).

Docling 60

Self-hosted rule. Free MIT software with nothing to buy, so 20 + 20 + 20, and no payment protocol (0). 60.

Amazon Textract 74

IAM with identity policies per action, temporary credentials from AWS STS and rotation. Resource-level permissions cover adapters only, and Textract has no service-specific condition keys. No secret travels in a URL (30). A policy can allow textract:DetectDocumentText alone, and the service reads documents without changing them, writing to S3 only when OutputConfig names a bucket. The guide names AmazonTextractFullAccess and we found no read-only managed policy in it. The only destructive calls delete adapters (16 of 20). Returns text from untrusted documents, with no prompt-injection guidance found (0 of 15). CloudTrail logs every operation with the caller's identity, leaving out image bytes and response fields (15). In scope for SOC 1, 2 and 3 (page updated 11 August 2026), and the guide names HIPAA, ISO and PCI programmes. Vulnerability disclosure programme on HackerOne. aws.amazon.com's security.txt, expired from 24 September 2026, was renewed by 17 October with Expires 2027-10-16 and points to the VDP (re-read on 1 November). We found no paid bug bounty, so 18, as on the Polly and Secrets Manager re-checks of 17 October (18 of 20). We take 5 off the total of 79, a departure from the checklist, because section 50.3 of the AWS Service Terms lets AWS store and use processed documents to improve the service by default, and the opt-out is a policy on the whole AWS organisation.

Docling 53

Framework reading. No credentials for local use; docling-serve has one optional shared key, off by default (20 of 30). Remote services are off unless explicitly enabled, local file fetch is guarded by flags, and MCP tools carry read-only and destructive annotations; manipulation tools can delete items and save files (12 of 20). Converted documents are untrusted text and no prompt-injection guidance was found (3 of 15). Logging only, no audit trail (3 of 15). A disclosure policy with private reporting, 28 advisories published in public with fixed versions, under the LF AI & Data Foundation; no bug bounty (15 of 20). 20+12+3+3+15 = 53. The advisories themselves are the deduction.

Amazon Textract 85

Closed service under the AWS Customer Agreement and section 50 of the Service Terms, with Apache-2.0 SDKs (20 of 30). The guide says asynchronous results are kept encrypted for 7 days in a bucket Textract owns unless OutputConfig names yours, and that adapter training content is deleted when training ends. Section 50.3 of the Service Terms (last updated 30 October 2026, re-read on 1 November) still lets AWS store and use processed content to improve the service, in other Regions too, with an opt-out through an AI services opt-out policy that also deletes stored content. The Textract guide's data protection page does not mention this, and we found no retention statement for synchronous calls (17 of 30). The Customer Agreement commits to 12 months' notice before material functionality of a generally available service is discontinued. No dated Textract deprecation notices found (15 of 20). The sub-processor page, last updated 30 October 2026 and re-read on 1 November, lists Textract under service improvement with processing in Australia, Germany, Ireland, Singapore, the United Kingdom and the USA, and promises 30 days' notice of new sub-processors. Region is chosen per request across 16 Regions (17 of 20).

Docling 65

MIT, an OSI licence, with model licences noted as separate (30). Runs locally, remote services off by default and air-gapped use documented; no privacy statement is needed for local use, but model downloads from Hugging Face on first run are only partly described (22 of 30). Breaking changes are marked in the changelog, with no deprecation policy or dated notices (10 of 20). No telemetry found in the source; nothing to opt out of (15 of 20). 30+22+10+15 = 77.

Amazon Textract 96

AWS Health Dashboard with per-service, per-Region history (20). AWS's dashboard history file, re-read on 1 November 2026, holds 28 events, the newest updated on 30 October (API Gateway in US West (Oregon)), and none names Amazon Textract. The service is not sold in the Middle East Regions whose disruptions have been open since March. The one event that names it is the US East (N. Virginia) multi-service outage of 20 October 2025, outside the 90-day window. The public dashboard shows broad events only (30). Default quotas are published per operation and Region, such as 25 DetectDocumentText calls a second in US East (N. Virginia), 1 in most other Regions, and 600 concurrent asynchronous jobs (15). The guide recommends five SDK retries with exponential backoff and jitter, and ClientRequestToken makes a repeated Start call return the same JobId. Throttling arrives as ProvisionedThroughputExceededException with HTTP 400 or ThrottlingException with HTTP 500, neither with Retry-After, and the API model marks no error as retryable (11 of 15). The Amazon Textract SLA, last updated 5 May 2022, commits 99.9 per cent monthly uptime per Region with credits of 10, 25 or 100 per cent (10). Generally available since 29 May 2019 (10).

Docling 85

Local-software lines, graded on the library with docling-serve and docling-mcp. Installs from PyPI (docling 2.148.0, per the PyPI release feed) for Python 3.10 and later on macOS, Linux and Windows (20). Public CI workflows for checks, tests and heavy examples; the pass state of the default branch was not read (20 of 25). About 719 open issues and 223 open pull requests on the repository page against 13 releases in four weeks, many of them fixes; replies not sampled (15 of 25). Semantic-release changelog with Feature and Fix sections and Breaking sections where they apply (15). Version 2.x since 2024 (15). 20+20+15+15+15 = 85.

Amazon Textract 70

Graded on the Textract API through the AWS CLI and SDKs. FeatureTypes selects what a call analyses, and queries return a named answer per question. The response is a flat list of blocks for every page, line and word, each with geometry and a confidence value, with no field selection, no way to omit word blocks and no Markdown or text output (12 of 25). Get operations page with MaxResults (1,000 blocks at most) and NextToken, and the two adapter list operations page and filter. No operation lists jobs and no block filter exists (13 of 20). 18 typed errors with HTTP codes and a recovery hint each, though throttling uses 400 and 500, not 429 (16 of 20). ClientRequestToken on the Start operations and on adapter creation, with IdempotentParameterMismatchException when a token is reused with different input. Synchronous calls change nothing but bill each attempt (18 of 20). DetectDocumentText needs only Document, and SDKs exist in every major language. Any PDF or TIFF of more than one page needs S3, an asynchronous job and polling or an SNS topic, and every call needs SigV4 (11 of 15).

Docling 77

About 25 MCP tools in the default groups (15), selectable as conversion, generation and manipulation groups, with anchor tools to read one part of a document (22 of 25). max_num_pages, max_file_size and page ranges on conversion, Markdown or JSON export (15 of 20). Errors are exceptions with messages, such as an unknown document key listing the valid ones (12 of 20). readOnlyHint and destructiveHint on the MCP tools, and conversions are repeatable (18 of 20). Sensible defaults and one call to convert; Python only, with a docling-client package for docling-serve (10 of 15). 22+15+12+18+10 = 77.