Geocodio vs HERE Location Services

Geocodio 86

API v2.1 released 3 November 2026 (Australia and New Zealand), and PHP library 3.4.1 on 4 November (30). Dated changelog entries on 8 September, 1, 8, 9, 19, 22 and 31 October and 3 November 2026, plus library releases in October (20). Public changelog, support by email and a team-staffed help desk named on the pricing page. We didn't read GitHub issue reply times (12). Official Python 1.6.0 and Node 2.3.0 from 12 October and PHP 3.4.1 from 4 November are current (15). Each library and the CLI run CI on GitHub Actions; we didn't check whether the runs pass (9). 30+20+12+15+9 = 86.

HERE Location Services 45

HERE's changelogs sit on docs.here.com, paused under the acceptable use policy, so entries after 9 October are unread. On the 9 October reading the newest dated entries are Matrix Routing 8.49.0 on 9 September 2026 (a documentation change) and Routing 8.162.0 on 7 September 2026, 58 days before this check (20). From 6 August only Routing 8.161.0 (11 August) and 8.162.0 (7 September) fall in the window, with the Matrix documentation change at half, 2.5 in all and short of three (0, cause time; 8.160.0 of 16 July has left the window). Changelogs are public for each API, and paid support plans state response times from 72 hours down to 4 (10 of 15). HERE's GitHub repositories, read as a third-party host, show the HERE SDK for Android, iOS and Flutter current, with example apps tagged for releases 4.27.2.0 (17 August), 4.27.3.0 (3 September), 4.28.0.0 (1 October) and 4.28.1.0 (2 November 2026), and their search and routing engines are the SDKs the ergonomics note credits. The Python client for the REST APIs has carried a deprecation notice since 5 September 2023. These SDK releases aren't counted on the release lines, because their release notes sit on HERE's paused pages and nothing read shows them changing the location services (15; the 5 carried isn't a checklist value). Package health isn't visible for a closed service, and the SDK examples repository has no CI workflow (0; the 5 carried isn't a checklist value). 20+0+10+15+0 = 45.

Geocodio 40

No x402, MPP or L402 (0). $1 per 1,000 lookups after the free tier, and per-credit rates for every Flex tier, public without login (20). 2,500 lookups a day free with no card until usage passes the free tier (20). Signup and key creation are a browser flow at dash.geocod.io (0). 0+20+20+0 = 40.

HERE Location Services 0

Readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). No x402, MPP or L402 was found in the docs index or the terms (0). The Base Plan price page is public, but its table is drawn by script and showed no prices to our reader, so per-request prices score as absent, a limit of our reading and not a finding that prices are hidden (0). HERE's docs say a new organisation can get started for free, but whether a card is asked for was not established, so the free-tier line can't be credited (0; the 10 carried isn't a checklist value). Sign-up is a browser flow with email verification (0). Support plans are priced in public, from $50 a month for the Developer plan. 0+0+0+0 = 0.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

HERE Location Services 63

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). Closed service under public, dated terms. The HERE Platform Terms, effective 18 September 2023, name the contracting entity by region and govern the Base Plan (15 of 30). The terms say HERE analyses use of the platform and uses anonymised or aggregated findings to develop its products, and Essential Data Processing domains switch that off. The privacy policy of 29 August 2024 says it does not cover processing done on behalf of customers and gives no retention periods. The DPA is a PDF we did not read (14 of 30). The Product Lifecycle Policy gives six months' notice before discontinuation and 6 to 12 months for a deprecated feature, and changelogs mark deprecations with dates (20). No sub-processor list or data location was found on the pages read (3 of 20). Total 52.

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

HERE Location Services 55

Graded on the REST APIs (Geocoding and Search v7, Routing v8) with the hosted lines. HERE's acceptable use policy bars data mining and scraping of HERE Materials, websites included, so HERE's hosts were not requested on 4 November and the 9 October readings stand. HERE's docs describe a public status page at status.here.com/status with current status, a status history tab and scheduled maintenance (per the 9 October check, not re-read on 4 November) (20). The page was drawn by script on 9 October and is now paused, so the record from 6 August is unread (5). No rate limit with a number was found in the docs; the Base Plan limits sit on a price page drawn by script (0; the 5 carried isn't a checklist value). The Limits and Quotas page says an exceeded quota returns 429 or 503 and that a surge can be throttled for about 10 minutes, and the OpenAPI definition lists 429, with no Retry-After header or backoff guidance and only reads involved (per the 9 October check, not re-read on 4 November). Documented 429 handling without backoff guidance reads at the line's 10 (the 7 carried isn't a checklist value). Monthly availability targets of 99.9 per cent are published for Geocoding and Search v7 and Routing v8, with service credits for the Essential support plan and above (per the 9 October check, not re-read on 4 November) (10). Both APIs are in the Active lifecycle stage (10). 20+5+0+10+10+10 = 55.

Geocodio 80

API reading. limit, opt-in fields appends and stable_address_key re-lookups size responses and cost, and results are ordered best first (20). Batches of 10,000 lookups, Lists for 10 million, distance filters (max_distance, max_results, order_by) and paginated list listings (17). Codes 403, 422, 429 and 500 each carry a documented meaning and retry rule, error bodies link a help page, and _warnings reports ignored parameters (18). Geocoding reads are safe to retry, but there's no idempotency key on batch or list creation and AGENTS.md says a retried request is billed again (10). One required parameter on a single geocode, and official libraries for Python, Node, PHP and Ruby plus a CLI with --agent output (15). 20+17+18+10+15 = 80.

HERE Location Services 93

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). limit sizes geocoding responses (1 to 100, default 20), and show and return parameters add optional blocks only when asked for. The MCP server lists 13 tools, two of them experimental, and passes cached route and isoline IDs between tools so geometry is not returned twice (18 of 25). Filters by country, result type, position and bounding area and a result limit are documented, with no offset or cursor paging for geocoding (20; the 15 carried isn't a checklist value, and filters with a size limit meet the line). Errors carry status, title, code, cause, action and correlationId, and the routing changelog names error codes such as E605502 (20; the 17 carried isn't a checklist value). The location calls are reads and safe to repeat (20; the 14 carried isn't a checklist value; MCP annotations were not read). A geocode needs only q and a credential, and HERE publishes SDKs in JavaScript, Android, iOS and Flutter, for maps rather than as REST clients (15; the 10 carried isn't a checklist value). 18+20+20+20+15 = 93.

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

HERE Location Services 65

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). Credentials are API keys, OAuth 2.0 client credentials and OAuth 2.1 private_key_jwt with a registered JWK, where the private key stays with the customer. Tokens are short-lived and can be scoped to a project, and an app holds two API keys or two JWKs for rotation (30). Less 10 because the documented API key method is the apiKey query parameter (20). The location services only read. Trusted domains limit where a key works, and app credentials do not inherit the user's permissions (15 of 20). Results carry place names from third-party sources. The Location Reasoning examples load a guardrails://location-reasoning-usage-policy resource and a hlr___secure_location_reasoning prompt, whose text was not read (7 of 15). A Usage API reports billable usage by app and project. Per-call logs were not found (6 of 15). ISO/IEC 27001:2022, 27701, 27017, 27018 and 42001 certificates, SOC 2 Type 2 scoped to Platform Foundation and Workspace, TISAX AL3 and CSA STAR Level 2 are listed. A disclosure policy of 13 July 2023 names security@here.com with a 90-day window. No bug bounty and no security.txt were found (17 of 20). Total 65.