Geocodio vs MapTiler Cloud

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Geocodio 86

API v2.1 released 3 November 2026 (Australia and New Zealand), and PHP library 3.4.1 on 4 November (30). Dated changelog entries on 8 September, 1, 8, 9, 19, 22 and 31 October and 3 November 2026, plus library releases in October (20). Public changelog, support by email and a team-staffed help desk named on the pricing page. We didn't read GitHub issue reply times (12). Official Python 1.6.0 and Node 2.3.0 from 12 October and PHP 3.4.1 from 4 November are current (15). Each library and the CLI run CI on GitHub Actions; we didn't check whether the runs pass (9). 30+20+12+15+9 = 86.

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.

Geocodio 80

API reading. limit, opt-in fields appends and stable_address_key re-lookups size responses and cost, and results are ordered best first (20). Batches of 10,000 lookups, Lists for 10 million, distance filters (max_distance, max_results, order_by) and paginated list listings (17). Codes 403, 422, 429 and 500 each carry a documented meaning and retry rule, error bodies link a help page, and _warnings reports ignored parameters (18). Geocoding reads are safe to retry, but there's no idempotency key on batch or list creation and AGENTS.md says a retried request is billed again (10). One required parameter on a single geocode, and official libraries for Python, Node, PHP and Ruby plus a CLI with --agent output (15). 20+17+18+10+15 = 80.

MapTiler Cloud 70

API reading. limit, types, bbox, proximity, country, language and fuzzyMatch size geocoding results, and the batch endpoint takes up to 50 queries (20). Country, bbox and type filters, no pagination (geocoding rarely needs it) (16). Errors are documented as 400 and 403 with no recovery guidance (10). Every public API reads and is safe to retry (12). Few required parameters, but official clients are JavaScript and TypeScript only, plus native mobile SDKs (12). 20+16+10+12+12 = 70.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.