DeepL API vs Localazy

DeepL API 82

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Keys go only in the Authorization header since query and body auth were switched off in January and February 2026. API Key Permissions, GA on 24 June 2026, scope a key to chosen endpoints, the Admin API creates, labels and deactivates developer keys, and the hosted MCP signs in with OAuth (30). DeepL says paid-plan texts aren't used for training without consent, while free services may keep content for a limited time to train models. The privacy policy doesn't say which side API Developer keys fall on (15 of 20). Paid-plan texts are deleted once the job is done, document translation runs on DeepL's own infrastructure in the EEA (12 of 15). Usage reports by key and custom reporting tag, and a trace ID per call, but no audit log of key use found (10 of 15). security.txt PGP-signed and valid to 2026-12-01 per the 30 September check, a security@deepl.com address in the repositories and SOC 2 Type II claimed. No bug bounty found (15 of 20).

Localazy 37

Bearer tokens in the Authorization header. A project token reaches every endpoint of one project with read and write access; a translation token reaches only the AI Translation endpoint; organisation tokens are in beta on request (20). The translation token is the only least-privilege option, and project tokens can delete keys and glossary items without a confirmation step (10). The API returns strings written by translators and contributors, with no guidance on untrusted content (5). No per-call log or audit trail for tokens found (2). localazy.com/.well-known/security.txt and /security return 404, and we found no disclosure policy or certification (0). 20+10+5+2+0 = 37.

DeepL API 95

OpenAPI 3 document (version 3.14.0, 45 paths on 1 November), synced from DeepL's docs to the DeepLcom/openapi repository (last sync 28 October 2026) and served at developers.deepl.com (25). llms.txt with 144 links and agent instructions, plus a keyless docs MCP server since 3 June 2026 (10). Operation descriptions say what each call does, and the docs say when to pick latency_optimized or quality_optimized, though not when to avoid an endpoint (15 of 20). Enums for formality, tag handling, model type and sentence splitting, with required fields marked (15). /v2/translate documents 11 response codes including 429, 456 and 529, with examples throughout (15). Versioned paths (v1, v2, v3) and a dated changelog (15).

Localazy 51

No OpenAPI or other machine-readable contract was found (0). localazy.com/llms.txt is a six-link index of top-level pages, with no Markdown docs for agents (5). Each endpoint page states which token types can call it, whether write permission is needed and the minimum role, and the limits page says to use the CDN, not the API, for production fetches (14). Request bodies list required and optional fields with limits, such as 512 characters for a key and 1,000 for a comment (12). Sample requests, responses and error responses per endpoint (13). Docs pages carry 'last updated' dates and the blog posts dated release updates, but there's no API version or changelog (7). 0+5+14+12+13+7 = 51.

DeepL API 81

Closed service with published terms, the MCP server and OpenAPI repository under MIT (15). The privacy policy and data security page agree that paid-plan texts are deleted after the job and not used for training without consent, but neither places API Developer keys (22 of 30). Dated deprecations in the changelog, query and body auth deprecated in November 2025 and cut off on 20 January 2026 after a brownout, /v2/languages deprecated on 18 May 2026 (18 of 20). EEA processing for documents and regional endpoints for some customers, but we didn't find a public sub-processor list outside the trust centre at trust.deepl.com (12 of 20).

Localazy 57

Editorial half only. Closed service under terms that name Localazy s.r.o. of Brno and Czech law; the CLI is BSD-3-Clause and the API client MIT (15). The privacy policy keeps data while the service is used and 24 months after, and includes a DPA, but says nothing on whether content sent to Localazy AI is used for training (15). No deprecation policy or dated notices found (0). The DPA links a list of suppliers and subprocessors on an external knowledge base we didn't read (10). 15+15+0+10 = 40.

DeepL API 83

API reading of the checklist. Responses carry the translation and detected language, with billed characters opt-in through show_billed_characters. The local MCP server has 13 compact tools, the hosted one up to 28 per DeepL's docs (22 of 25). Many strings per call up to 128 KiB, paging on style rules and translation memories, up to 5 glossaries a request (18 of 20). Errors carry a message, a code where available and a trace ID, and the docs say which codes to retry (20). Text translation is stateless with backoff guidance, but document jobs take no idempotency key and the MCP tools carry no readOnlyHint or destructiveHint annotations (10 of 20). Two required fields on translate, official SDKs for Python, Node.js and others, but a free key sent to the paid host fails (13 of 15).

Localazy 62

API reading. List endpoints return whole projects, files and keys with few output controls (13). Filtering by file, language and tags, and batch imports of up to 1,000 keys and 50 files a request (14). Error responses are documented per endpoint, with HTTP codes and messages (12). No idempotency keys, and the docs warn against parallel imports into the same new file (8). Official TypeScript API client, a CLI and Android and iOS libraries, with few required fields (15). 13+14+12+8+15 = 62.

DeepL API 52

Status page at status.deepl.com, which the changelog says became one combined page with an API view on 16 July 2026 (20). The page renders only in a browser, and /history, the Statuspage JSON path and an RSS feed all return the same empty application shell on 1 November, so we couldn't read its incidents. That's our limit, not a finding, but the rubric gives 5 for history we can't read (5). Request size limits are published (128 KiB a request, 16 KiB of headers) and plan character caps, and the error-handling guide says there is no fixed request-per-second figure because the service adjusts to load (5 of 15). 429 and 529 mean wait and resend, 456 means a usage limit was reached, and the guide says to retry 429 and 5xx with exponential backoff and jitter, to honour Retry-After when a response includes one and to log X-Trace-ID. It doesn't say which responses carry Retry-After, and document uploads take no idempotency key (12 of 15). No SLA found for self-serve plans (0). The text and document APIs are GA (10).

Localazy 68

Hosted lines, for the REST API at api.localazy.com. Better Stack status page with Web, API, Public API, Payments and Connect API components and 30, 60 and 90-day uptime (20). The incidents page reports none for September, October or November 2026, but the Public API shows 99.805% uptime in one 30-day bucket, roughly an hour and a half of downtime with no incident posted, so the line is held below clean (25). Limits per plan of 100 requests a minute and 10 a second, plus daily import and fetch caps per project (15). No 429 or retry guidance found in the API docs (0). No SLA found on the pricing page or in the terms (0). The core API is GA; the AI Translation endpoint is marked beta (8). 20+25+15+0+0+8 = 68.

DeepL API 87

Changelog entries on 28 and 29 October 2026 (30). 19 dated changelog entries on 15 days since 3 August and 15 deepl-mcp-server releases in the same window, the newest 1.3.15 on 14 October (20). Public changelog, support centre and an issue triage workflow on the MCP repository, but we didn't read the GitHub issues (12 of 15). Official SDKs current, the MCP server pins deepl-node 1.28.1 (15). The MCP server runs CI on every push, with Renovate keeping dependencies current (latest update 30 October) (10).

Localazy 75

@localazy/api-client 2.3.2 on 26 October 2026 (30). Releases 2.3.0 (12 August), 2.3.1 (29 September) and 2.3.2 (26 October) in the last 90 days (20). Support by email, blog release updates, and public GitHub repositories, but we didn't read issue reply times (7). The TypeScript client and the CLI (2.0.12 on 31 July 2026) are current (13). The client repository shows coverage badges; we didn't confirm CI runs (5). 30+20+7+13+5 = 75.