HERE Location Services vs Woosmap

HERE Location Services 0

Readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). No x402, MPP or L402 was found in the docs index or the terms (0). The Base Plan price page is public, but its table is drawn by script and showed no prices to our reader, so per-request prices score as absent, a limit of our reading and not a finding that prices are hidden (0). HERE's docs say a new organisation can get started for free, but whether a card is asked for was not established, so the free-tier line can't be credited (0; the 10 carried isn't a checklist value). Sign-up is a browser flow with email verification (0). Support plans are priced in public, from $50 a month for the Developer plan. 0+0+0+0 = 0.

Woosmap 30

No x402, MPP or L402 (0). Plans and per-API tier breakpoints are public, but per-request prices sit in a script-driven calculator we couldn't read, so plan-only credit (10). Free plan up to 10,000 requests a month with 'No Credit Card Required' (20). A person signs up and creates a key in the console (0). 0+10+20+0 = 30.

HERE Location Services 55

Graded on the REST APIs (Geocoding and Search v7, Routing v8) with the hosted lines. HERE's acceptable use policy bars data mining and scraping of HERE Materials, websites included, so HERE's hosts were not requested on 4 November and the 9 October readings stand. HERE's docs describe a public status page at status.here.com/status with current status, a status history tab and scheduled maintenance (per the 9 October check, not re-read on 4 November) (20). The page was drawn by script on 9 October and is now paused, so the record from 6 August is unread (5). No rate limit with a number was found in the docs; the Base Plan limits sit on a price page drawn by script (0; the 5 carried isn't a checklist value). The Limits and Quotas page says an exceeded quota returns 429 or 503 and that a surge can be throttled for about 10 minutes, and the OpenAPI definition lists 429, with no Retry-After header or backoff guidance and only reads involved (per the 9 October check, not re-read on 4 November). Documented 429 handling without backoff guidance reads at the line's 10 (the 7 carried isn't a checklist value). Monthly availability targets of 99.9 per cent are published for Geocoding and Search v7 and Routing v8, with service credits for the Essential support plan and above (per the 9 October check, not re-read on 4 November) (10). Both APIs are in the Active lifecycle stage (10). 20+5+0+10+10+10 = 55.

Woosmap 78

Hosted lines. Atlassian Statuspage at status.woosmap.com with seven components (Localities, Store Search, Geolocation, Distance, Address, Map and Indoor APIs) (20). The status home page lists no incidents from 23 October to 6 November 2026. The full history page loads by script and the site's robots.txt disallows /api/, so the rest of the 90 days wasn't read and the line is held between the unreadable and minor tiers (10). Each endpoint's reference states its own rate limit, such as 50 a second, shared by a project's keys (15). Every response carries RateLimit-Policy and RateLimit headers, and the rate-limits page says to wait t seconds after a 429, retry at most three times and back off 1, 2 and 4 seconds when the header is missing, with sample code (15). A 99.9% SLA on the Enterprise plan per the pricing page; we didn't read its terms (8). GA (10). 20+10+15+15+8+10 = 78.

HERE Location Services 65

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). Credentials are API keys, OAuth 2.0 client credentials and OAuth 2.1 private_key_jwt with a registered JWK, where the private key stays with the customer. Tokens are short-lived and can be scoped to a project, and an app holds two API keys or two JWKs for rotation (30). Less 10 because the documented API key method is the apiKey query parameter (20). The location services only read. Trusted domains limit where a key works, and app credentials do not inherit the user's permissions (15 of 20). Results carry place names from third-party sources. The Location Reasoning examples load a guardrails://location-reasoning-usage-policy resource and a hlr___secure_location_reasoning prompt, whose text was not read (7 of 15). A Usage API reports billable usage by app and project. Per-call logs were not found (6 of 15). ISO/IEC 27001:2022, 27701, 27017, 27018 and 42001 certificates, SOC 2 Type 2 scoped to Platform Foundation and Workspace, TISAX AL3 and CSA STAR Level 2 are listed. A disclosure policy of 13 July 2023 names security@here.com with a 90-day window. No bug bounty and no security.txt were found (17 of 20). Total 65.

Woosmap 43

Public keys are read-only and must carry a domain or IP restriction. Private keys are read-only or read and write (fixed at creation), restricted by IP, iOS or Android, and can go in an X-Api-Key header. Less 10 because private_key in the query string is a documented option and the default in the spec (17). Read-only keys and the read/write split give least privilege; no confirmation step on dataset deletes was found (16). find_nearby and get_place_details return public POI data, ratings and opening hours, with no prompt-injection guidance (7). Console usage per project wasn't checked (3). www.woosmap.com/.well-known/security.txt returns 404, and we found no disclosure policy, bug bounty or certification (0). 17+16+7+3+0 = 43.

HERE Location Services 45

HERE's changelogs sit on docs.here.com, paused under the acceptable use policy, so entries after 9 October are unread. On the 9 October reading the newest dated entries are Matrix Routing 8.49.0 on 9 September 2026 (a documentation change) and Routing 8.162.0 on 7 September 2026, 58 days before this check (20). From 6 August only Routing 8.161.0 (11 August) and 8.162.0 (7 September) fall in the window, with the Matrix documentation change at half, 2.5 in all and short of three (0, cause time; 8.160.0 of 16 July has left the window). Changelogs are public for each API, and paid support plans state response times from 72 hours down to 4 (10 of 15). HERE's GitHub repositories, read as a third-party host, show the HERE SDK for Android, iOS and Flutter current, with example apps tagged for releases 4.27.2.0 (17 August), 4.27.3.0 (3 September), 4.28.0.0 (1 October) and 4.28.1.0 (2 November 2026), and their search and routing engines are the SDKs the ergonomics note credits. The Python client for the REST APIs has carried a deprecation notice since 5 September 2023. These SDK releases aren't counted on the release lines, because their release notes sit on HERE's paused pages and nothing read shows them changing the location services (15; the 5 carried isn't a checklist value). Package health isn't visible for a closed service, and the SDK examples repository has no CI workflow (0; the 5 carried isn't a checklist value). 20+0+10+15+0 = 45.

Woosmap 26

No dated API release, changelog or release note found. The newest dated activity we saw is the public woosmap-samples repository on 16 September 2026, which isn't an API release (10). No dated changes to count in the last 90 days (0). Support by email and a support centre, with no public changelog (5). Official JavaScript, iOS and Android SDKs exist, but we couldn't check their versions because the GitHub API was rate-limited and two SDK repository names didn't resolve; the MCP server isn't in the official MCP registry (8). The samples carry tests, per the rate-limits page (3). 10+0+5+8+3 = 26.

HERE Location Services 93

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). limit sizes geocoding responses (1 to 100, default 20), and show and return parameters add optional blocks only when asked for. The MCP server lists 13 tools, two of them experimental, and passes cached route and isoline IDs between tools so geometry is not returned twice (18 of 25). Filters by country, result type, position and bounding area and a result limit are documented, with no offset or cursor paging for geocoding (20; the 15 carried isn't a checklist value, and filters with a size limit meet the line). Errors carry status, title, code, cause, action and correlationId, and the routing changelog names error codes such as E605502 (20; the 17 carried isn't a checklist value). The location calls are reads and safe to repeat (20; the 14 carried isn't a checklist value; MCP annotations were not read). A geocode needs only q and a credential, and HERE publishes SDKs in JavaScript, Android, iOS and Flutter, for maps rather than as REST clients (15; the 10 carried isn't a checklist value). 18+20+20+20+15 = 93.

Woosmap 76

API reading, with the hosted MCP server's nine tools as a second surface. Localities and Stores responses can be narrowed by type, components and fields, and the MCP set is small (20). Store search takes query filters, radius and paging, and the Distance Matrix has an async mode for large jobs (17). Documented error codes including 402 for billing and 429 with reset timing (17). Reads are safe to retry, but no idempotency key was found for the Datasets and Stores write endpoints, and the MCP docs don't mention tool annotations (10). Official JavaScript, iOS and Android SDKs and samples in Python and JavaScript, with few required parameters (12). 20+17+17+10+12 = 76.

HERE Location Services 63

All readings per the 9 October check, not re-read on 4 November (HERE's hosts paused). Closed service under public, dated terms. The HERE Platform Terms, effective 18 September 2023, name the contracting entity by region and govern the Base Plan (15 of 30). The terms say HERE analyses use of the platform and uses anonymised or aggregated findings to develop its products, and Essential Data Processing domains switch that off. The privacy policy of 29 August 2024 says it does not cover processing done on behalf of customers and gives no retention periods. The DPA is a PDF we did not read (14 of 30). The Product Lifecycle Policy gives six months' notice before discontinuation and 6 to 12 months for a deprecated feature, and changelogs mark deprecations with dates (20). No sub-processor list or data location was found on the pages read (3 of 20). Total 52.

Woosmap 54

Editorial half only. Closed service under online terms that name WOOSMAP SAS of Montpellier and the Commercial Court of Paris (15). The privacy policy covers website visitors only, and we found no statement on how long API request data is kept (5). The pricing page says the Address API is 'being deprecated for Pro Plan subscriptions', with no date (5). The legal notice says the site is hosted by Amazon Web Services; no sub-processor list or data location for the APIs was found (6). 15+5+5+6 = 31.