Datalab vs Mistral OCR API

Datalab 79

Closed hosted service. Python SDK 0.9.1 on 6 November 2026 and a changelog entry on 4 November (30). Over twenty dated changelog entries since 8 August (20). Support by email, a Discord and public GitHub repositories for the open-source models; replies not sampled (12 of 15). An official Python SDK, current, no other languages (12 of 15). Package health not checked beyond release dates (5 of 10). 30+20+12+12+5 = 79.

Mistral OCR API 58

Model reading, on the lines mistral-api uses. OCR 4.0 was retired on 30 September 2026 and the last OCR release, OCR 4.1's GA, was on 31 August, both within 90 days of 4 November. The changelog has no OCR entry since 29 September (20). The lifecycle page promises 6 months' notice for GA models and 1 month for Public Preview. OCR 4.0 (mistral-ocr-4-0, released 23 June 2026) was deprecated on 29 September and retired on 30 September, one day, per its model card and the changelog. Earlier OCR retirements gave 29 days (mistral-ocr-2503) and 93 days (mistral-ocr-2505) (0 of 12). One OCR shutdown date in the 90 days to 4 November, and it didn't keep the published notice (0 of 8). Dated release notes several times a month, read as mistral-api reads the same changelog (10 of 15). SDK repository replies not sampled (5 of 10). mistralai 3.7.0 and @mistralai/mistralai 3.5.0 on 1 November per each repository's RELEASES.md (15). Both SDKs are generated from the OpenAPI document and run custom-code tests and example scripts in CI (8 of 10). 20+0+0+10+5+15+8 = 58.

Datalab 56

Several hashed API keys with per-key 30-day spend caps, revoke-and-replace rotation, no scopes (24 of 30). Spend caps limit damage; results and files can be deleted by the key holder, and there's no read-only key (10 of 20). Returns document text with no prompt-injection guidance (2 of 15). cost_breakdown per request and usage tracking in the dashboard (8 of 15). A Secureframe trust centre and a SOC 2 report on the Team plan, TOTP enforcement for teams; no disclosure policy or security.txt found (12 of 20). 24+10+2+8+12 = 56.

Mistral OCR API 70

Model reading, as mistral-api and mistral-voxtral-transcribe read the same pages. Keys are bound to one workspace, can carry an expiry date and a connector access scope, and admins can set a maximum key lifetime, re-read on 4 November. A key can't be limited to OCR or to read-only use (26 of 30). The commercial terms say Mistral won't train on customer data unless the customer opted in, or didn't opt out where a product defaults to opt-in, without naming the API's default, and free-tier data may train models (10 of 20). Inputs and outputs are kept 30 days for abuse monitoring. The zero data retention page lists /v1/ocr for paid plans, granted per request after review, and excludes /v1/files, the route the OCR guide gives for private uploads (12 of 15). Audit logs cover API key actions on Enterprise plans only, per the 2 October check on mistral-api (10 of 15). security.txt re-read on 4 November (expires 5 May 2027, HackerOne policy link), and the docs publish three dated security advisories for 2026. No certification or bounty confirmed (12 of 20). 26+10+12+10+12 = 70.

Datalab 73

Output as Markdown, HTML, JSON or chunks, page_range to limit pages, and cost_breakdown on results (20 of 25). File listing and pipeline endpoints, little else to paginate (14 of 20). Typed errors with retry guidance an agent can follow (18 of 20). No idempotency key; the docs say to poll a known request ID instead of resubmitting, and webhooks may be retried (12 of 20). Official Python SDK and CLI, one language (9 of 15). 20+14+18+12+9 = 73.

Mistral OCR API 83

Model reading adapted to OCR. Responses can be cut to selected pages, images are left out unless include_image_base64 is set, and blocks and confidence scores are opt-in (22 of 25). pages, include_blocks, extract_header and extract_footer and the confidence granularity are the output controls (16 of 20). Error glossary with a fix per status (15 of 20). A synchronous, stateless call that's safe to retry. The error glossary now gives a retry strategy and the SDKs retry with backoff, and no idempotency key exists or is needed, read as the transcription listing (15 of 20). Two required fields, model and document, and official SDKs in Python and TypeScript (15). 22+16+15+15+15 = 83.

Datalab 68

Closed service under terms effective 30 June 2026 naming Endless Labs, Inc. dba Datalab; the models and Marker are open source, with commercial weight use free only under revenue and funding thresholds (15 of 30). Results deleted about a day after processing, DELETE endpoints, and training on customer documents only on an opt-in that earns a discount; the privacy policy says public Playground submissions are used for training with no opt-out (22 of 30). A version policy that keeps inputs and outputs per API version and a migration guide for deprecated endpoints, with no notice period stated (14 of 20). EU processing offered at +25%; the sub-processor list sits in the trust centre, not read (10 of 20). 15+22+14+10 = 61.

Mistral OCR API 76

Closed models under commercial terms with a French legal entity, SDKs Apache-2.0 (15). The terms, the DPA, the zero data retention page and the 30-day abuse window agree with each other, but the terms leave the paid API's training default unnamed, read as mistral-api (18 of 30). The lifecycle page gives notice periods per stage and a 404 after retirement, but OCR 4.0 was retired one day after its deprecation notice, short of every period the page promises (12 of 20). EU hosting by default with opt-in regional endpoints and a published subprocessor list, per the moderation listing's check (15 of 20). 15+18+12+15 = 60.

Datalab 58

Hosted lines. Status page at status.datalab.to (incident.io) with Website and Datalab API components; the history page is drawn by script, so components are confirmed and history isn't (15 of 20, 5 for history). Rate limits per plan with numbers, plus page and size limits (15). 429 is retryable with sample backoff, and 500 and 529 say to check a known request ID before resubmitting; webhooks deduplicate by request_id (13 of 15). Custom SLAs only for Enterprise (0). Generally available (10). 15+5+15+13+0+10 = 58.

Mistral OCR API 53

Hosted reading. status.mistral.ai on Rootly has an OCR API component with 90-day uptime bars, per the 1 October check (20), the reading the other Mistral listings keep. The page has answered every request with a Cloudflare bot check since 8 October, robots.txt included on 4 November, so the host is treated as blocked and the 90 days from 6 August were not re-read. The 1 October reading of August and September OCR incidents is not credited either way (5, unread and not a finding against the vendor), as mistral-voxtral-transcribe reads the same page. The usage and limits page says OCR limits can include pages per minute, with the numbers shown only in the Admin Panel (3 of 15, as the other Mistral listings). The error glossary tells callers to back off exponentially on 429, 500, 502, 503 and 504 and to check the Retry-After header, and the official SDKs retry with backoff. OCR is a stateless call with no write, read as the transcription listing's (15). No SLA found (0). OCR 4.1 is GA per its model card (10). 20+5+3+15+0+10 = 53.