Geocodio vs Nominatim

Geocodio 92

OpenAPI 3.0.1 spec, version 2.1.0, with 11 paths (25). llms.txt and an AGENTS.md written for agents (10). llms.txt and AGENTS.md say when to use each endpoint and when not to, such as the Lists API over looping single calls, the upload tool for a one-off spreadsheet and straightline over driving distance unless road distance is needed (19). Typed parameters with country values, component fields and documented limits, though fields is a comma-separated string (12). Error table with retry guidance, examples throughout, but the spec documents 200, 400, 403, 404, 422 and 424 and not 429 or 500 (11). Versioned paths from v1 to v2.1 and a dated public changelog with entries back to 2024 (15). 25+10+19+12+11+15 = 92.

Nominatim 51

No OpenAPI or machine-readable contract (0). nominatim.org/llms.txt returns 404, and the manual is HTML, though its Markdown sources sit in the repository's docs folder (0). The API reference explains each endpoint and parameter and when not to use one, such as the details endpoint being for debugging (14). Types, enums and limits are documented, such as format, layer and limit (at most 40), but there's no schema to validate against (12). Example queries and outputs per endpoint, with errors described in prose (10). A versioned manual per release, a ChangeLog and a migration guide (15). 0+0+14+12+10+15 = 51.

Geocodio 87

Editorial half only. Closed service with clear, dated terms under Virginia law, and libraries and CLI under MIT (20). The privacy policy says API and spreadsheet input and results are deleted within 45 days, error logs kept 90 days, and customer data isn't used to train AI models. A separate data retention policy and llms.txt put Lists API data at 72 hours. Results may be stored permanently by the customer (27). Replaced API versions are guaranteed for at least 12 months, breaking changes come only with a new version, and the changelog marks each one 'Breaking' (18). The privacy policy names its processors, such as Sentry and Laravel Nightwatch, and the security page says self-serve is hosted in Europe (15). 20+27+18+15 = 80.

Nominatim 59

Open source, GPL-3.0-or-later for the Python code, GPL-2.0 for other files and Apache-2.0 for the osm2pgsql Lua styles (30). A self-hosted server keeps data where the operator runs it. The public instance falls under the OSMF privacy policy and asks users not to send personal data. We didn't read the OSMF policy itself (20). SECURITY.md lists the end of security support for each release line with dates, and a migration guide covers each version (16). No telemetry found in the settings, and request logging is opt-in (15). 30+20+16+15 = 81.

Geocodio 86

API v2.1 released 3 November 2026 (Australia and New Zealand), and PHP library 3.4.1 on 4 November (30). Dated changelog entries on 8 September, 1, 8, 9, 19, 22 and 31 October and 3 November 2026, plus library releases in October (20). Public changelog, support by email and a team-staffed help desk named on the pricing page. We didn't read GitHub issue reply times (12). Official Python 1.6.0 and Node 2.3.0 from 12 October and PHP 3.4.1 from 4 November are current (15). Each library and the CLI run CI on GitHub Actions; we didn't check whether the runs pass (9). 30+20+12+15+9 = 86.

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

Geocodio 40

No x402, MPP or L402 (0). $1 per 1,000 lookups after the free tier, and per-credit rates for every Flex tier, public without login (20). 2,500 lookups a day free with no card until usage passes the free tier (20). Signup and key creation are a browser flow at dash.geocod.io (0). 0+20+20+0 = 40.

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Geocodio 70

Hosted lines. incident.io status page at status.geocod.io with five components (Geocodio API, Dashboard, Enterprise API, Enterprise Dashboard, Website) and an incidents feed at /api/v2/incidents.json (20). In the 90 days to 6 November 2026 the feed lists one incident marked major, 'Spreadsheet geocoding jobs are failing' on 27 October from 12:35 to 15:15 UTC, and a PHP security patch on 21 October marked no impact, so one major outage of a core feature (10). 1,000 requests a minute on single geocoding for pay-as-you-go and Flex, 100 on Enterprise Flex (15). 429 carries X-RateLimit-Remaining, -Limit and -Period, and llms.txt and AGENTS.md give a retry rule per status code with capped backoff, plus client-side idempotency guidance for the non-idempotent list and batch writes (15). The pricing page lists custom SLAs as an add-on on Unlimited and Enterprise plans, with no published terms, so no SLA (0). GA (10). 20+10+15+15+0+10 = 70.

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

Geocodio 58

Revocable keys, five on pay-as-you-go, each with permissions (Lists and Distance off by default), which earns 25. Less 10 because the docs say 'All requests require &api_key=YOUR_API_KEY' and the OpenAPI spec defines only the query scheme, though an Authorization header has worked since March 2025 (15). Per-key permissions limit what a key can reach. DELETE on lists and distance jobs needs no confirmation (13). Results are addresses and government district, census and legislator data rather than user-written text. No prompt-injection guidance found (9). Usage per API key in the dashboard, downloadable as CSV, and billable-lookup headers on every response (8). Valid security.txt to 30 January 2030 with a PGP key and a responsible disclosure policy. SOC 2 Type II and annual penetration tests apply to the Enterprise platform only. No bug bounty found (13). 15+13+9+8+13 = 58.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.