Datalab vs Invofox

Datalab 79

Closed hosted service. Python SDK 0.9.1 on 6 November 2026 and a changelog entry on 4 November (30). Over twenty dated changelog entries since 8 August (20). Support by email, a Discord and public GitHub repositories for the open-source models; replies not sampled (12 of 15). An official Python SDK, current, no other languages (12 of 15). Package health not checked beyond release dates (5 of 10). 30+20+12+12+5 = 79.

Invofox 20

No changelog or versioned release of the API was found. The self-serve launch on 5 October 2026 opened sign-up and API keys to new users but changed no documented API behaviour, and a service start isn't a recency source in this run; the docs sitemap date of 7 October 2026 records no change. No dated API change was found on the docs, the site's llms.txt or the blog, whose newest post is from 7 August 2026. The vendor's newest dated release is its n8n community node n8n-nodes-invofox 0.1.0, tagged on 3 July 2026, 125 days before 5 November (10). No three dated releases in the last 90 days (0). Community support on Free and email support on Starter, replies not sampled, no public changelog (3 of 15). No official SDK, and the n8n node is the vendor's only package (3 of 15). That repository has CI and publish workflows and no commit since 3 July (4 of 10). 10 + 0 + 3 + 3 + 4 = 20.

Datalab 58

Hosted lines. Status page at status.datalab.to (incident.io) with Website and Datalab API components; the history page is drawn by script, so components are confirmed and history isn't (15 of 20, 5 for history). Rate limits per plan with numbers, plus page and size limits (15). 429 is retryable with sample backoff, and 500 and 529 say to check a known request ID before resubmitting; webhooks deduplicate by request_id (13 of 15). Custom SLAs only for Enterprise (0). Generally available (10). 15+5+15+13+0+10 = 58.

Invofox 25

No public status page found. status.invofox.com still doesn't resolve on 5 November and neither the site nor the docs link to one (0 of 20). No readable incident history (5 of 30). No rate limit numbers, and the vendor's AI briefing still says rate limits are not publicly documented (0 of 15). The main OpenAPI file documents 429 with RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and Retry-After headers, and the docs ask for exponential backoff, but uploads take no idempotency key (10 of 15). The pricing page lists a 99.9% uptime SLA on Starter, but no SLA document was found, and this run scores a pricing-page SLA figure with no document 0 (0 of 10). The API is in production use and self-serve since 5 October 2026 (10). 0 + 5 + 0 + 10 + 0 + 10 = 25.

Datalab 89

An OpenAPI 3.1 operation embedded in each reference page (spec version 0.0.1), no single downloadable file found (22 of 25). llms.txt with 159 pages and Markdown twins (10). Recipes say when to use each processor and mode (15 of 20). Typed request schemas with enums for output format and mode (12 of 15). An error table with type, HTTP code and whether to retry, plus SDK exception mapping (15). A written version policy and a dated changelog (15). 22+10+15+12+15+15 = 89.

Invofox 70

Three public OpenAPI 3.1 files, main (25 operations), ingest (7) and webhooks (7 events) (25). llms.txt on both the site and the docs, and every docs page has a Markdown twin (10). The guides say when to use webhooks or polling and how rejected files behave, but 11 of the 25 main operations have no description (12 of 20). States, confidence and error codes are enums and limit has a maximum of 500, while info is a JSON string inside multipart and filter is a JSON string in the query (9 of 15). Examples in curl, Python and Node.js and tables of error codes, with inconsistencies. A sample shows ERR_PASSWORD_PROTECTED, which is missing from the code table, the main file's error text says 50 MB and 10 pages where the ingest file says 100 MB, and webhook samples show version 1.0 and 1.2 (9 of 15). Ingest paths carry /v1 and webhook events a version field, and no public changelog was found (5 of 15).

Datalab 56

Several hashed API keys with per-key 30-day spend caps, revoke-and-replace rotation, no scopes (24 of 30). Spend caps limit damage; results and files can be deleted by the key holder, and there's no read-only key (10 of 20). Returns document text with no prompt-injection guidance (2 of 15). cost_breakdown per request and usage tracking in the dashboard (8 of 15). A Secureframe trust centre and a SOC 2 report on the Team plan, TOTP enforcement for teams; no disclosure policy or security.txt found (12 of 20). 24+10+2+8+12 = 56.

Invofox 45

API keys in an x-api-key header, created in the dashboard and scoped to one environment, which is either TEST or PRODUCTION. Revocation and rotation are not described in the docs we read (20 of 30). Environment scoping is the only least-privilege control found. The same key reaches the delete endpoints for users, companies, providers and clients, with no read-only key or confirmation (6 of 20). The API returns text taken from untrusted documents and no prompt-injection guidance was found (0 of 15). Document and import lists record channel and creator, and no audit log is documented (5 of 15). security.txt is valid until 1 June 2027 with security@invofox.com. The site states SOC 2 Type II, ISO 27001:2022, GDPR and HIPAA compliance and links a Vanta trust centre we could not read without JavaScript. No bug bounty found (14 of 20).

Datalab 68

Closed service under terms effective 30 June 2026 naming Endless Labs, Inc. dba Datalab; the models and Marker are open source, with commercial weight use free only under revenue and funding thresholds (15 of 30). Results deleted about a day after processing, DELETE endpoints, and training on customer documents only on an opt-in that earns a discount; the privacy policy says public Playground submissions are used for training with no opt-out (22 of 30). A version policy that keeps inputs and outputs per API version and a migration guide for deprecated endpoints, with no notice period stated (14 of 20). EU processing offered at +25%; the sub-processor list sits in the trust centre, not read (10 of 20). 15+22+14+10 = 61.

Invofox 57

Closed service. The published terms are a website legal notice, and the General Terms and Conditions that the DPA cites were not found on the site. The DPA and NDA are public (12 of 30). The zero-retention page says the standard pipeline keeps documents and that real documents tune the model, with no default retention period stated. Zero retention is opt-in for Scale and Enterprise. The DPA allows three months of access after termination and gives 48 hours for breach notice (15 of 30). Five operations and several fields are marked deprecated in the OpenAPI files with replacements named and no removal dates (5 of 20). The DPA points to a sub-processor list in the trust centre, which we could not read, with 15 days' notice of changes. The site states EU and US processing regions (8 of 20).

Datalab 40

No x402, MPP or L402 (0). Per-1,000-page rates for every processor and add-on on the public pricing page (20). A $10 to $20 monthly allowance with no card (20). A person signs up in a browser (0). 0+20+20+0 = 40.

Invofox 30

No x402, MPP or L402 (0). Plan prices are public, Free at $0 for 500 pages and Starter from $500 a month billed annually for up to 5,000 pages, but no per-page or overage rate is published and Scale and Enterprise are custom (10 of 20). The free plan needs no card (20). A person signs up in a browser at app.invofox.com and creates the key in the dashboard (0).