DeepL API vs TranslatePlus

DeepL API 87

Changelog entries on 28 and 29 October 2026 (30). 19 dated changelog entries on 15 days since 3 August and 15 deepl-mcp-server releases in the same window, the newest 1.3.15 on 14 October (20). Public changelog, support centre and an issue triage workflow on the MCP repository, but we didn't read the GitHub issues (12 of 15). Official SDKs current, the MCP server pins deepl-node 1.28.1 (15). The MCP server runs CI on every push, with Renovate keeping dependencies current (latest update 30 October) (10).

TranslatePlus 10

The newest dated change found is translateplus-python 2.0.7 and translateplus-js 2.0.1 on 11 January 2026, about ten months before this check, and the API changelog stops at 9 December 2024 (0). No release or dated change in the last 90 days (0). Support by email and a support portal; the status page hasn't updated since January (3). SDKs exist for four languages but haven't changed since January (5). Weekly downloads of 4 (PyPI) and 6 (npm) (2). 0+0+3+5+2 = 10.

DeepL API 82

Model reading of the checklist, with training and retention in place of the least-privilege and injection lines. Keys go only in the Authorization header since query and body auth were switched off in January and February 2026. API Key Permissions, GA on 24 June 2026, scope a key to chosen endpoints, the Admin API creates, labels and deactivates developer keys, and the hosted MCP signs in with OAuth (30). DeepL says paid-plan texts aren't used for training without consent, while free services may keep content for a limited time to train models. The privacy policy doesn't say which side API Developer keys fall on (15 of 20). Paid-plan texts are deleted once the job is done, document translation runs on DeepL's own infrastructure in the EEA (12 of 15). Usage reports by key and custom reporting tag, and a trace ID per call, but no audit log of key use found (10 of 15). security.txt PGP-signed and valid to 2026-12-01 per the 30 September check, a security@deepl.com address in the repositories and SOC 2 Type II claimed. No bug bounty found (15 of 20).

TranslatePlus 35

One API key per account in the X-API-KEY header, which the docs say 'carries full access to your account's resources', and can be revoked in the dashboard (15). No scopes or read-only keys (5). Translations return the caller's own text, so little untrusted content (10). llms.txt claims request logging and an analytics dashboard, which we couldn't see without an account (5). translateplus.io/.well-known/security.txt returns 404 and no disclosure policy was found; llms.txt says 'SOC 2 compliant' and 'SOC 2 Type II certified infrastructure' with no report or auditor named (0). 15+5+10+5+0 = 35.

DeepL API 95

OpenAPI 3 document (version 3.14.0, 45 paths on 1 November), synced from DeepL's docs to the DeepLcom/openapi repository (last sync 28 October 2026) and served at developers.deepl.com (25). llms.txt with 144 links and agent instructions, plus a keyless docs MCP server since 3 June 2026 (10). Operation descriptions say what each call does, and the docs say when to pick latency_optimized or quality_optimized, though not when to avoid an endpoint (15 of 20). Enums for formality, tag handling, model type and sentence splitting, with required fields marked (15). /v2/translate documents 11 response codes including 429, 456 and 529, with examples throughout (15). Versioned paths (v1, v2, v3) and a dated changelog (15).

TranslatePlus 52

No OpenAPI or other machine-readable contract found in the docs or either llms.txt (0). llms.txt on the site and on docs.translateplus.io (10). Endpoint pages say what each call does, with little on when to choose HTML, email or i18n jobs over plain text (10). Required fields and per-plan character limits per request are documented, without enums for language codes beyond a supported-languages call (10). Code examples in several languages and an error-handling guide with status codes (12). Versioned /v1 and /v2 paths and a changelog, whose newest entry is 2.0.0 on 9 December 2024 (10). 0+10+10+10+12+10 = 52.

DeepL API 81

Closed service with published terms, the MCP server and OpenAPI repository under MIT (15). The privacy policy and data security page agree that paid-plan texts are deleted after the job and not used for training without consent, but neither places API Developer keys (22 of 30). Dated deprecations in the changelog, query and body auth deprecated in November 2025 and cut off on 20 January 2026 after a brownout, /v2/languages deprecated on 18 May 2026 (18 of 20). EEA processing for documents and regional endpoints for some customers, but we didn't find a public sub-processor list outside the trust centre at trust.deepl.com (12 of 20).

TranslatePlus 52

Editorial half only. Closed service under terms last updated 18 December 2024 that name PetaBytes, Inc. as a US corporation but give no address, governing law or courts (10). The terms say translation requests aren't permanently stored 'unless required by law', the privacy policy says 'unless required for caching or service improvement purposes', and the terms allow using anonymised usage data to improve the service (8). API v1 is kept as legacy, with no dated deprecation notice (5). No subprocessor list or data location found (0). 10+8+5+0 = 23.

DeepL API 83

API reading of the checklist. Responses carry the translation and detected language, with billed characters opt-in through show_billed_characters. The local MCP server has 13 compact tools, the hosted one up to 28 per DeepL's docs (22 of 25). Many strings per call up to 128 KiB, paging on style rules and translation memories, up to 5 glossaries a request (18 of 20). Errors carry a message, a code where available and a trace ID, and the docs say which codes to retry (20). Text translation is stateless with backoff guidance, but document jobs take no idempotency key and the MCP tools carry no readOnlyHint or destructiveHint annotations (10 of 20). Two required fields on translate, official SDKs for Python, Node.js and others, but a free key sent to the paid host fails (13 of 15).

TranslatePlus 61

API reading. Batch translation of up to 100 texts a call and separate HTML, email, subtitle and i18n job endpoints (16). Few output controls or filters (10). Errors are a detail string with HTTP status codes (12). No idempotency key for i18n jobs, though text translation is stateless (8). Official SDKs listed for Python, JavaScript and TypeScript, Java and PHP, with few required fields (15). 16+10+12+8+15 = 61.

DeepL API 52

Status page at status.deepl.com, which the changelog says became one combined page with an API view on 16 July 2026 (20). The page renders only in a browser, and /history, the Statuspage JSON path and an RSS feed all return the same empty application shell on 1 November, so we couldn't read its incidents. That's our limit, not a finding, but the rubric gives 5 for history we can't read (5). Request size limits are published (128 KiB a request, 16 KiB of headers) and plan character caps, and the error-handling guide says there is no fixed request-per-second figure because the service adjusts to load (5 of 15). 429 and 529 mean wait and resend, 456 means a usage limit was reached, and the guide says to retry 429 and 5xx with exponential backoff and jitter, to honour Retry-After when a response includes one and to log X-Trace-ID. It doesn't say which responses carry Retry-After, and document uploads take no idempotency key (12 of 15). No SLA found for self-serve plans (0). The text and document APIs are GA (10).

TranslatePlus 45

Hosted lines. status.translateplus.io is the vendor's own page; on 6 November 2026 it showed 'All systems unknown' and a last update of 22 January 2026, with data loading by script (5). No incident history to read (5). The rate-limits guide gives 100,000 requests a minute and 100,000,000 an hour per key, while llms.txt gives 50 requests a second on the Free plan, so limits are published but inconsistent (10). 429 returns a JSON detail message, responses carry X-RateLimit-Limit, -Remaining and -Reset, and the guide shows waiting for the reset with capped retries (15). No SLA. The terms say TranslatePlus strives for 99.9% uptime 'but do not guarantee uninterrupted service' (0). API v2 is the current, non-beta version (10). 5+5+10+15+0+10 = 45.