Azure Maps vs Nominatim

Azure Maps 20

No x402, MPP or L402 (0). Per-1,000-transaction prices are public without a login through the Azure Retail Prices API, $4.50 on each Gen2 meter. The pricing page showed our reader the free amounts but no dollar figures (20), re-read on 1 November. Free monthly transactions exist, 5,000 for search and 1,000 for routing, but an Azure account asks for a card to verify identity (0). A person signs up in a browser and creates the Maps account (0). 0+20+0+0 = 20.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Azure Maps 83

OpenAPI 2.0 documents for each service are public in Azure/azure-rest-api-specs, generated from TypeSpec since April 2026 (25). learn.microsoft.com returns each page as Markdown when ?accept=text/markdown is added, though llms.txt returns 404 (10). Operation descriptions state purpose, and the geocoding and migration pages say when to use geocoding, autocomplete or batch and when not to (16 of 20). Typed parameters with ranges such as top from 1 to 20, 18 enums in the Search document and 48 in Route, and required fields marked (13 of 15). Examples on all 16 Search and Route operations, but errors are one default response with an x-ms-error-code header and no list of codes found (10 of 15). Dated api-version values and migration guides for Search, Route, Render and Traffic 1.0, but no API changelog page. The release notes cover the Web SDK only (9 of 15). 25+10+16+13+10+9 = 83.

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Azure Maps 66

Microsoft Entra ID OAuth tokens with Azure roles, SAS tokens limited to 24 hours with a rate cap and allowed regions, and two subscription keys that can be regenerated in turn (30). Less 10 because the authentication guide tells callers to add the subscription key as a URL parameter, and Search 1.0 declares the key as a query parameter (20). Built-in reader roles, custom roles down to one service such as Microsoft.Maps/accounts/services/search/read, and disableLocalAuth to turn keys off. The data-plane APIs only read. A subscription key reaches every API on the account (18 of 20). Place names, addresses and traffic incident text come from third parties, and no prompt-injection guidance was found (5 of 15). Azure Monitor metrics show usage, errors and availability for 93 days. Per-request logs were not found in the Azure Maps docs (6 of 15). MSRC coordinated disclosure and bounty policies, and Azure Maps is on the FedRAMP High audit scope list dated 21 September 2026. The microsoft.com security.txt passed its Expires date on 23 September 2026 and still carries it on 1 November, and we did not confirm Maps on a SOC 2 scope list. An MSRC search on 1 November finds no CVE naming Azure Maps since November 2025 (17 of 20). 20+18+5+6+17 = 66.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Azure Maps 75

Closed service under Microsoft's Product Terms, which carry a section of Azure Maps rules on storage, navigation and attribution, with MIT client libraries (15 of 30). The docs say requests and input data are stored only in the chosen geography and that queries go to TomTom without a link to the customer. No retention period for request data was found, and we did not read the Data Protection Addendum (22 of 30). The Modern Lifecycle Policy promises 12 months' notice before support ends. Gen1 pricing and Render 1.0 retired on stated dates in September 2026, while Search 1.0 is superseded with no date (16 of 20). TomTom is named as a subprocessor, and European and United States endpoints fix the data location. The full sub-processor list sits on the Service Trust Portal, which we did not read (16 of 20). 15+22+16+16 = 69.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.