Databento vs Twelve Data

Databento 50

Graded as a hosted service. Atlassian Statuspage at status.databento.com with ten components, Portal, Historical, FTP and seven live feeds (20). The incident feed for the 90 days to 3 November 2026 lists a critical outage of the portal and Historical API on 6 August lasting about eight hours, critical live authentication timeouts in NY4 on 28 August for about seven hours, major batch job delays of about two days each opened on 6 and 12 October, a six-hour GLBX.MDP3 delay in the Historical API on 6 October, and a Frankfurt outage affecting XEUR and XEEE opened on 2 November and still in monitoring. Several majors (0 of 30). Per-IP limits are published with numbers (15). 429 with a Retry-After header and a code to sleep on it; streams cut off aren't billed for unsent data, batch jobs are billed once (15). No SLA found; the pricing page names none and the terms were unreadable (0). The HTTP API is at major version 0 and the docs say it is not considered stable (0 of 10). Total 50.

Twelve Data 83

Read with the hosted lines. A public status page at twelvedata.isitup.cloud lists Price API, Fundamentals API, WebSocket and Website with uptime figures (20). Its history shows two incidents in the 90 days to 3 November 2026, 20 minutes of unavailability across the three APIs on 1 September and 16 minutes on the WebSocket on 14 October, minor only (20). Limits are published with numbers, credits a minute by plan from 8 to 10,946 and 800 a day on Basic (15). The docs document a 429 on the limit and the usage endpoint, with no Retry-After or backoff guidance; reads only (8 of 15). The terms sell a 99.9 per cent SLA with service credits, and the Enterprise plan carries 99.99 per cent (10). The REST API and MCP server are generally available (10). 20 + 20 + 15 + 8 + 10 + 10 = 83.

Databento 49

A closed service whose terms could not be read, because databento.com/legal and its /terms and /privacy pages are drawn by script; the client libraries are Apache-2.0 (10 of 30). The privacy policy was unread for the same reason, and the docs say nothing about retention of account data (0 of 30, unchecked). Dated release notes carry deprecations, and the versioning policy keeps a prior major version for a year after the next (18 of 20). No subprocessor list or data location statement was found on readable pages; the architecture docs name the company's own data centres (0 of 20). Total 28.

Twelve Data 67

A closed service under terms that name the entity, define internal use, business use and redistribution, and were last updated 1 January 2026; the MCP repository is open source but ships no licence file (15 of 30). The privacy policy of 22 September 2026 states retention periods and names its processors, the terms require data deletion within 30 days of termination, and no DPA is named (20 of 30). No deprecation policy or notice period; the terms allow changes and the monthly updates record them after the fact (3 of 20). Subprocessors are named on the privacy policy and the trust centre, with no data locations beyond transfer mechanisms (12 of 20). 15 + 20 + 3 + 12 = 50.

Databento 75

No OpenAPI document was found. The contract is the per-endpoint reference with typed parameters, the DBN schemas with field tables and enums, and a .http.md variant of every page (8 of 25). llms.txt and a Markdown twin of every page with language variants (10). Endpoint pages say what each call returns and the basics pages say when to use streaming against batch (15 of 20). Typed parameters with enums for schema, encoding, symbology type and split duration (13 of 15). Code in Python, C++, Rust and curl on every page, and an error table with codes, named error identifiers and a docs link in each body (14 of 15). Semantic versioning with dated release notes per component, breaking changes and deprecations called out (15). Total 75.

Twelve Data 83

A public OpenAPI 3.1 document covers 187 operations, every one with a description and 200, 400, 401, 403, 404, 414, 429 and 500 responses, and the MCP tools in the source carry typed inputs and annotations (25). llms.txt on the site and in the docs link Markdown pages per section, pricing.md and auth.md (10). Descriptions state purpose, plan requirement and credit cost, with little on when not to use an endpoint (16 of 20). Required parameters are marked and the Markdown lists interval, adjust and type values, but none of the 3,091 parameters in the spec declares an enum (9 of 15). Examples with a demo key on every endpoint and an error table with codes and meanings (13 of 15). No version in the path, a spec at version 0.0.1, and monthly dated product updates on the news page rather than an API changelog (10 of 15). 25 + 10 + 16 + 9 + 13 + 10 = 83.

Databento 22

No x402, MPP or L402 (0). Plans are public ($199, $1,750 and $4,500 a month) and historical data is metered per GB, but the per-dataset rates are in the portal catalogue behind a login and the pricing page's estimator shows only an example (12 of 20). $125 of credits for every new user, expiring after six months; whether a card is needed at signup was not found on the pricing, credits or billing pages (10 of 20). A person signs up in a browser and creates keys in the portal; no key API (0). Total 22.

Twelve Data 30

No x402, MPP or L402 (0). Plan prices are public without login in pricing.md and on the pricing page, sold by credits a minute per month rather than per call (10). A free Basic plan at 800 credits a day with no card (20). The key comes from a browser signup and no key API was found; MCP needs an OAuth login by a person (0). 0 + 10 + 20 + 0 = 30.

Databento 61

Named API keys, up to 100 per account, rotated or deleted in the portal, with per-member permissions, sent only as the Basic auth username; no scopes per key and no expiry (25 of 30). Every API call is a read, and a monthly historical limit caps what a leaked key can spend; live usage is not capped (14 of 20). The API returns market data and reference records, not free text from third parties (10). A data usage page in the portal and a billing page per cycle, with no per-key call log documented (8 of 15). The vendor revokes keys it finds in public and documents key hygiene; security.txt returns 404 and no bounty, SOC 2 or ISO 27001 was found on readable pages (4 of 20). Total 61.

Twelve Data 54

The REST key is a plain per-account key with no scopes, accepted as a header or as ?apikey= (20 less 10 for the query string). The hosted MCP server refuses keys and uses OAuth 2.1 with PKCE, a resource indicator, refresh tokens, revocation and one scope, which lifts the credential model for that surface (18 of 30). Every operation is a read (15 of 20). Company news is third-party text and no guidance was found (5 of 15). An /api_usage endpoint and dashboard usage give the key holder a view of consumption, not a per-call log (6 of 15). A trust centre on SafeBase lists SOC 2, GDPR and CCPA and ten policies; no security.txt, disclosure process or bug bounty was found (10 of 20). 18 + 15 + 5 + 6 + 10 = 54.