CloudConvert API vs DocRaptor

CloudConvert API 58

cloudconvert-cli 3.0.2 was published to npm on 21 October 2026 and adds an ai/agent command for the new AI tasks, which the privacy policy's dated entry of 19 October also records (30). In the 90 days from 3 August, the MCP server launch post (3 September), and Java 1.2.5, Ruby 1.2.0 (both 24 August) and CLI 3.0.2, the package tags counted half, so 2.5. The privacy policy's dated entry of 19 October records a policy text, not a release, and the ai/agent launch it describes is already counted through CLI 3.0.2 (0). No changelog. Support is a contact form and email, and dependency pull requests on the Java and CLI repositories were merged on 5 October and 23 October 2026. Issue replies were not read (8 of 15). Six official SDKs, four released in 2026. The Node.js SDK's last tag is still April 2025 (3.0.0) and the Python SDK's March 2022, and the MCP server is not in the official registry, searched on 1 November (12). Every SDK repository has a test workflow (8). 30 + 0 + 8 + 12 + 8 = 58.

DocRaptor 21

Read as a closed service with open-source clients. The last dated product change found is the changelog entry of 5 September 2023, and the client libraries were last tagged in 2023 (docraptor-python 3.1.0 on 19 July 2023, npm docraptor 1.0.1 on 28 December 2023); the about and security pages were rewritten after the October 2025 acquisition but carry no dated API change (0). No releases in the last 90 days (0). Support by email, site chat and a help centre with stated hours, and a per-document help request from the dashboard; GitHub issue replies couldn't be read (8 of 15). Official clients in six languages exist and still match the API, but none has shipped since 2023 (10). The Python client pins 2023 dependencies and its test suite runs through tox with no CI workflow in the repository (3). 0 + 0 + 8 + 10 + 3 = 21.

CloudConvert API 71

API keys are created with any of six scopes and can be revoked, and OAuth 2.0 issues tokens for third-party clients, though the implicit grant is still supported and no key rotation is documented. Signed URLs carry an HMAC signature, not the key (27). A key limited to task.read is read-only, and the MCP server asks for three scopes, one of them task.write, plus the two webhook scopes for its webhook tools. No confirmation step for deletes (12). Results come back as download links, and the metadata and capture-website operations handle untrusted content. The MCP page tells users to connect only the official URL, with no prompt-injection guidance (6). The security page says all access is logged and reviewable by the customer in activity logs, and jobs can be filtered by API key (11). ISO 27001 from TÜV Süd, and a valid security.txt (re-read on 1 November, Expires 2027-05-01) with a disclosure policy and rewards only at CloudConvert's discretion, so no formal bounty. No public advisories and nothing on OSV for the SDK packages. That's above ahasend's 12 (ISO 27001 and a disclosure route, no security.txt) (15). 27 + 12 + 6 + 11 + 15 = 71.

DocRaptor 41

One API key per account with no scopes, sent as the HTTP Basic username, and the docs offer user_credentials in the query string as a second method, which costs the 10 points for a secret in a URL (0 of 30). Test mode limits spend but there is no read-only key, and the destructive action, expiring a hosted document, needs no confirmation (6). The API renders the caller's HTML and returns a PDF or spreadsheet, not text for the model to read (10). The dashboard's document log records each job with input, output and log when the account's retention allows, and an IP listing API exists; no per-key audit log (8). SOC 2 Type II, HIPAA BAAs, annual third-party penetration tests, a vulnerability disclosure policy with security@docraptor.com and DPF registration, but no security.txt (17). 0 + 6 + 10 + 8 + 17 = 41.

CloudConvert API 80

Graded as a hosted service. Status page at status.cloudconvert.com (Better Stack) with nine components and 90-day bars (20). The incident list and RSS feed, re-read on 1 November, add one incident since 9 October, "iWork and Web are down" on 12 October. iWork recovered within two minutes and Web, the web interface rather than the API, recovered at 11:51 UTC on 13 October. With the EU Central slowdown on 8 October (from about 15:25 to 16:45 UTC), the US East, iWork and EU Central alert on 14 September and the other short incidents since 3 August, each touched one region, one conversion type or one component, so minor incidents only (20). Limits on creating jobs and tasks are described as dynamic, with X-RateLimit-Limit and X-RateLimit-Remaining headers and a free-plan cap of 5 concurrent tasks. The new ai/agent tasks have a fixed 6 requests a minute and 60 an hour, but the main endpoints have no fixed number per plan (8). A 429 carries Retry-After in seconds and the docs say CloudConvert retries retryable errors itself. No idempotency key (12). The terms promise 99.9 per cent monthly uptime with refunds on paid plans, re-read on 1 November (10). API v2 is generally available and the MCP server carries no beta label. Only the new ai/agent task is marked beta (10). 20 + 20 + 8 + 12 + 10 + 10 = 80.

DocRaptor 68

Read with the hosted lines. status.docraptor.com is an Atlassian Statuspage with components (20). Its front page reported no incidents on any of the days it lists, the history page needs JavaScript our reader lacks, and history.rss redirects to an inactive feed, so the record is clean for the days we could read and unread beyond them (20). The limits page gives numbers, 60 seconds synchronous, 600 asynchronous, 30 simultaneous requests and 100 MB hosted output (15). Too many simultaneous requests answer 403 with no Retry-After or backoff guidance, callbacks are retried up to three times, and there is no idempotency key (3). No SLA found; the about page's 99.99 per cent uptime is a marketing figure and the terms are unread (0). GA (10). 20 + 20 + 15 + 3 + 0 + 10 = 68.

CloudConvert API 75

Closed service with terms (12 April 2022) that cover API use, and MIT SDKs (18). The privacy policy, now dated 19 October 2026, gives 24 hours for files, 72 hours for account data after deletion and 180 days for logs, which agrees with the docs' 24-hour task deletion. The 19 October update adds the AI chat and AI tasks, an AI log of requests, file names and results kept 180 days and used to fix errors and to evaluate and train the AI models for these functions, with an opt-out in the dashboard that deletes existing logs, which the AI docs repeat. A DPA is signed on request (25). No deprecation policy. The terms give 30 days' notice only if the whole service is discontinued, and the operations endpoint flags deprecated engine versions (5). Hosting, payment, support and AI companies are named with addresses (Claude through Amazon Bedrock in EU data centres, Qwen through OVHcloud), and regions are Germany and Virginia, with no separate sub-processor list (16). 18 + 25 + 5 + 16 = 64.

DocRaptor 69

Closed service; the terms render through a script and were not read, the client libraries are MIT (12). The security FAQ states retention options, that logs hold metadata only, that content isn't used for model training and that metadata may be used for analytics, and the privacy policy on artifex.com of 19 November 2025 names the entities; the sub-processor list is a help-centre page that rendered empty for our reader (18). Pipelines 1 to 7 were deprecated with a dated notice in 2020 and pipeline versions are selectable, but there is no written notice period (12). AWS us-east-1 is named as the processing location and the FAQ says customers are emailed when the sub-processor list changes, though the list itself was unread (12). 12 + 18 + 12 + 12 = 54.