Azure Maps vs NextBillion.ai

Azure Maps 81

Hosted reading. Azure status page with a history of post-incident reviews (20). The history, re-read on 1 November, lists two reviews in the 90 days from 3 August and none since 1 October, Azure OpenAI and AI services in Sweden Central on 29 September and gateway services in several regions from 20:30 UTC on 30 September to 02:15 UTC on 1 October. The West US review of 23 July has left the window. None names Azure Maps. The page lists only broad incidents, so there is no service-level history for Maps, and we count the record as minor (20 of 30), as the other Azure listings do. Default limits published per service, 500 requests a second for search, 250 for reverse geocoding and 50 for routing, on the limits page re-read on 1 November (15). The service answers 429 over the limit and doesn't bill 429, 408 or 5xx responses, and data-plane calls are reads, so a retry is safe. No Retry-After header or backoff guidance was found in the reviewed documentation (6 of 15). The SLA for Online Services of 1 October 2026 commits to 99.9 per cent per API, with 10 and 25 per cent credits, per the 8 October check (10). Search 2026-01-01 and Route 2025-01-01 are stable versions. The REST index still labels autocomplete a preview (10). 20+20+15+6+10+10 = 81.

NextBillion.ai 45

Hosted lines, for the REST APIs at api.nextbillion.io and the hosted MCP server. A status page at status.nextbillion.io, 'NextBillion.AI API Status', renders only in a browser, and its Statuspage-style JSON paths return 404, so we couldn't see its components (10) or read any history. That's our limit, not a finding, and the rubric gives 5 (5). The API reference states 2,400 queries a minute, or 40 a second, for continuous requests (15). Each endpoint's error table lists 429 as 'QPM or API request count quota reached', with no Retry-After or backoff guidance (5). No SLA found; the terms say access isn't warranted to be uninterrupted (0). The REST APIs are GA. The MCP server is at version 0.5.3 (10). 10+5+15+5+0+10 = 45.

Azure Maps 66

Microsoft Entra ID OAuth tokens with Azure roles, SAS tokens limited to 24 hours with a rate cap and allowed regions, and two subscription keys that can be regenerated in turn (30). Less 10 because the authentication guide tells callers to add the subscription key as a URL parameter, and Search 1.0 declares the key as a query parameter (20). Built-in reader roles, custom roles down to one service such as Microsoft.Maps/accounts/services/search/read, and disableLocalAuth to turn keys off. The data-plane APIs only read. A subscription key reaches every API on the account (18 of 20). Place names, addresses and traffic incident text come from third parties, and no prompt-injection guidance was found (5 of 15). Azure Monitor metrics show usage, errors and availability for 93 days. Per-request logs were not found in the Azure Maps docs (6 of 15). MSRC coordinated disclosure and bounty policies, and Azure Maps is on the FedRAMP High audit scope list dated 21 September 2026. The microsoft.com security.txt passed its Expires date on 23 September 2026 and still carries it on 1 November, and we did not confirm Maps on a SOC 2 scope list. An MSRC search on 1 November finds no CVE naming Azure Maps since November 2025 (17 of 20). 20+18+5+6+17 = 66.

NextBillion.ai 46

The REST APIs take a single key query parameter, so a plain key that travels in URLs, which earns 20 less 10. The MCP server adds OAuth 2.1 with PKCE, seals the key into tokens with AES-256-GCM, accepts a Bearer header and stores nothing server-side, so 5 back (15). Every tool is read-only, and keys can carry an IP allowlist (12). Places results are POI and address text with no prompt-injection guidance (7). Usage alerts at 50, 75 and 90 per cent of credits, per the pricing FAQ. No per-call log found (5). /.well-known/security.txt returns 404, and we found no disclosure policy or bug bounty. The about page says the company follows ISO 27001 standards, without naming a certificate (7). 15+12+7+5+7 = 46.

Azure Maps 75

Closed service under Microsoft's Product Terms, which carry a section of Azure Maps rules on storage, navigation and attribution, with MIT client libraries (15 of 30). The docs say requests and input data are stored only in the chosen geography and that queries go to TomTom without a link to the customer. No retention period for request data was found, and we did not read the Data Protection Addendum (22 of 30). The Modern Lifecycle Policy promises 12 months' notice before support ends. Gen1 pricing and Render 1.0 retired on stated dates in September 2026, while Search 1.0 is superseded with no date (16 of 20). TomTom is named as a subprocessor, and European and United States endpoints fix the data location. The full sub-processor list sits on the Service Trust Portal, which we did not read (16 of 20). 15+22+16+16 = 69.

NextBillion.ai 58

Editorial half only. Closed service under terms that name NextBillion.ai Pte. Ltd. and Singapore law, and an Apache-2.0 MCP server (18). The privacy policy keeps personal data while a legitimate business need exists, with no periods given. The MCP README says only tool arguments are sent to the API and nothing is retained between requests (14). No deprecation policy or dated notices found. The terms promise 10 days' notice of material changes to the terms (3). Data is mainly processed in Singapore, with transfers abroad under standard clauses. No sub-processor list found (8). 18+14+3+8 = 43.

Azure Maps 57

Read as a closed service with official SDKs. The spec repository's newest Maps API or description changes are from 30 September 2026, removing Render 1.0 after its retirement on 17 September and clarifying autocomplete result types, 32 days before 1 November. The commits since then under the Maps folder (8 and 14 October) only change TypeSpec tooling and linter settings, so they don't count (20). Dated Maps changes since 3 August include description and example fixes on 28 August, 1 September, 14, 16 and 23 September and the two of 30 September, plus the Gen1 pricing retirement on 15 September (20). No API changelog. Microsoft Q&A and a feedback forum are linked from each docs page, which we did not read (8 of 15). The REST client libraries are all beta and lag the service. The azure-sdk changelogs date azure-maps-search 2.0.0b2 and azure-maps-route 1.0.0b3 to 12 December 2024 and @azure-rest/maps-search 2.0.0-beta.4 and @azure-rest/maps-route 1.0.0-beta.6 to 22 August 2025, with the next betas unreleased (5 of 15). The libraries live in the azure-sdk monorepos, CI not checked (4 of 10). 20+20+8+5+4 = 57.

NextBillion.ai 73

MCP server 0.5.3 on 30 October 2026 (30). Eleven tagged MCP releases between 7 October and 30 October, adding hosted mode, truck routing and geometry tools (20). Support by email, a public MCP repository with a changelog, but no public API changelog (8). The MCP server isn't in the official MCP registry, and we didn't check the mobile SDK versions (7). The MCP repository runs CI with unit and end-to-end tests (8). 30+20+8+7+8 = 73.

Azure Maps 83

OpenAPI 2.0 documents for each service are public in Azure/azure-rest-api-specs, generated from TypeSpec since April 2026 (25). learn.microsoft.com returns each page as Markdown when ?accept=text/markdown is added, though llms.txt returns 404 (10). Operation descriptions state purpose, and the geocoding and migration pages say when to use geocoding, autocomplete or batch and when not to (16 of 20). Typed parameters with ranges such as top from 1 to 20, 18 enums in the Search document and 48 in Route, and required fields marked (13 of 15). Examples on all 16 Search and Route operations, but errors are one default response with an x-ms-error-code header and no list of codes found (10 of 15). Dated api-version values and migration guides for Search, Route, Render and Traffic 1.0, but no API changelog page. The release notes cover the Web SDK only (9 of 15). 25+10+16+13+10+9 = 83.

NextBillion.ai 73

No OpenAPI document for the REST APIs was found in llms.txt or the docs. The hosted MCP server's 27 tools are defined with Zod schemas, so they carry typed JSON Schema inputs (15 of 25). llms.txt, llms-full.txt and a Markdown file for each docs page (10). Endpoint pages explain each parameter, and MCP tool descriptions say when not to use a tool, such as the geometry tools being straight-line rather than road distance (16). Parameter tables give types, allowed values and defaults, such as types and limit (default 10), though in packs several filters into one string (12). curl examples and a per-endpoint error table with causes (13). The MCP server has a dated changelog. No API changelog or versioned path was found (7). 15+10+16+12+13+7 = 73.