Databento vs Massive (formerly Polygon.io)

Databento 22

No x402, MPP or L402 (0). Plans are public ($199, $1,750 and $4,500 a month) and historical data is metered per GB, but the per-dataset rates are in the portal catalogue behind a login and the pricing page's estimator shows only an example (12 of 20). $125 of credits for every new user, expiring after six months; whether a card is needed at signup was not found on the pricing, credits or billing pages (10 of 20). A person signs up in a browser and creates keys in the portal; no key API (0). Total 22.

Massive (formerly Polygon.io) 90

x402 on its own domain at agent.massive.com since 1 September, but only 23 US stock routes. Options, indices, forex, crypto, futures, tick data and streaming still need a key (30 of 40). $0.01 a route on Agentic.Market, which the docs link to, and plan prices on massive.com/pricing, all without a login (20). Free Basic plan at 5 calls a minute with end-of-day data. The pricing page doesn't say a card is needed (20). An agent with a funded Base wallet can pay with no account (20).

Databento 50

Graded as a hosted service. Atlassian Statuspage at status.databento.com with ten components, Portal, Historical, FTP and seven live feeds (20). The incident feed for the 90 days to 3 November 2026 lists a critical outage of the portal and Historical API on 6 August lasting about eight hours, critical live authentication timeouts in NY4 on 28 August for about seven hours, major batch job delays of about two days each opened on 6 and 12 October, a six-hour GLBX.MDP3 delay in the Historical API on 6 October, and a Frankfurt outage affecting XEUR and XEEE opened on 2 November and still in monitoring. Several majors (0 of 30). Per-IP limits are published with numbers (15). 429 with a Retry-After header and a code to sleep on it; streams cut off aren't billed for unsent data, batch jobs are billed once (15). No SLA found; the pricing page names none and the terms were unreadable (0). The HTTP API is at major version 0 and the docs say it is not considered stable (0 of 10). Total 50.

Massive (formerly Polygon.io) 78

Atlassian Statuspage at massive-status.com with REST, WebSocket and flat-file components for each asset class (20). The history feed lists 14 unplanned incidents from 3 August to 1 November 2026, each limited to one product, one endpoint, one asset class or some accounts. They include US equity aggregate bars missing for roughly two-thirds of US equities from 18:46 ET on 8 September until 10:29 the next day, stale stocks quotes on 20 August, and slow responses with intermittent 502s on stocks v2 aggregates from 10:37 to 13:08 ET on 2 September. The newest, on 27 October, was delayed WebSocket data and REST errors for some accounts from 13:49 to 14:17 EDT. Read the way partial incidents are read on other listings, that is minor incidents only (20). Free plan limited to 5 calls a minute, paid plans unlimited, nothing stated for x402 (10 of 15). No 429 or Retry-After guidance found in the docs or the OpenAPI file, though the official Python client retries 429 with backoff (8 of 15). The business terms dated 6 October 2026 point to a separate Support Policy and SLA document for customers who buy service levels (10). The REST API is generally available (10).

Databento 61

Named API keys, up to 100 per account, rotated or deleted in the portal, with per-member permissions, sent only as the Basic auth username; no scopes per key and no expiry (25 of 30). Every API call is a read, and a monthly historical limit caps what a leaked key can spend; live usage is not capped (14 of 20). The API returns market data and reference records, not free text from third parties (10). A data usage page in the portal and a billing page per cycle, with no per-key call log documented (8 of 15). The vendor revokes keys it finds in public and documents key hygiene; security.txt returns 404 and no bounty, SOC 2 or ISO 27001 was found on readable pages (4 of 20). Total 61.

Massive (formerly Polygon.io) 35

A plain account key with no scopes, sent as a Bearer header or as ?apiKey= in the query string, a documented option (20 less 10, so 10). The x402 route at agent.massive.com needs no key. Read-only market data with no write actions (15 of 20). The x402 set includes news and SEC filing text written by third parties, and we found no guidance on treating it as untrusted (5 of 15). Paid x402 calls leave an on-chain USDC transfer. We found no request log documented for keyed callers (5 of 15). security.txt returns 404, and the terms and privacy policy name no SOC 2, ISO 27001, bug bounty or disclosure policy, only safeguards 'consistent with general industry standards' (0 of 20).

Databento 49

A closed service whose terms could not be read, because databento.com/legal and its /terms and /privacy pages are drawn by script; the client libraries are Apache-2.0 (10 of 30). The privacy policy was unread for the same reason, and the docs say nothing about retention of account data (0 of 30, unchecked). Dated release notes carry deprecations, and the versioning policy keeps a prior major version for a year after the next (18 of 20). No subprocessor list or data location statement was found on readable pages; the architecture docs name the company's own data centres (0 of 20). Total 28.

Massive (formerly Polygon.io) 67

Closed service under business terms last updated 6 October 2026, Massive.com, Inc. under Georgia law, which now also cover pay-per-request purchases without an account. The MCP server and clients are MIT (15). Privacy policy last updated 22 March 2024, with retention 'as long as we are providing the Services' and no periods. The business terms require deleting data on termination. No DPA found (12 of 30). Dated sunsets in the changelog. The terms let Massive change the Services at its discretion, with a 30-day route to report a change that materially degrades a subscribed service (10 of 20). Stripe, Google and Hotjar are named, and data may sit 'in the United States and locations around the world'. No subprocessor list (8 of 20).

Databento 75

No OpenAPI document was found. The contract is the per-endpoint reference with typed parameters, the DBN schemas with field tables and enums, and a .http.md variant of every page (8 of 25). llms.txt and a Markdown twin of every page with language variants (10). Endpoint pages say what each call returns and the basics pages say when to use streaming against batch (15 of 20). Typed parameters with enums for schema, encoding, symbology type and split duration (13 of 15). Code in Python, C++, Rust and curl on every page, and an error table with codes, named error identifiers and a docs link in each body (14 of 15). Semantic versioning with dated release notes per component, breaking changes and deprecations called out (15). Total 75.

Massive (formerly Polygon.io) 89

OpenAPI document at api.massive.com/openapi (OpenAPI 3.0.3, 148 paths) with enums such as timespan and sort, and 400, 401 and 404 responses defined (25). llms.txt at massive.com/docs/rest/llms.txt indexing about 160 endpoint pages (10). One-line descriptions per endpoint in the index, longer ones in the reference, with little on when not to use a call (14 of 20). Typed path and query parameters with enums and required fields (13 of 15). Examples in the docs and error responses in the spec, though the llms.txt says nothing about error shapes (12 of 15). Versioned paths from /v1 to /v3 and a dated public changelog (15).