Lokalise vs TranslatePlus

Lokalise 84

python-lokalise-api 5.0.0 on 26 October 2026 (Python 3.11 or later, announced in 4.3.0), @lokalise/node-api 17.0.0 and 17.0.1 on 23 October (Vantage API client) and a product changelog entry on 23 October (30). Since 3 August, six Node SDK releases, three Python releases and 15 dated changelog entries (20). Public changelog and 24/7 support listed on the pricing page. The CLI still has no release since v3.1.7 of 14 July 2026, and its 62 open issues and pull requests rest on the 8 October count (11 of 15). Official SDKs are current (15). The Node SDK runs CI on GitHub Actions across Node 22 to 26 and needs Node 22.19 or later, and the CLI builds with GoReleaser (8 of 10).

TranslatePlus 10

The newest dated change found is translateplus-python 2.0.7 and translateplus-js 2.0.1 on 11 January 2026, about ten months before this check, and the API changelog stops at 9 December 2024 (0). No release or dated change in the last 90 days (0). Support by email and a support portal; the status page hasn't updated since January (3). SDKs exist for four languages but haven't changed since January (5). Weekly downloads of 4 (PyPI) and 6 (npm) (2). 0+0+3+5+2 = 10.

Lokalise 84

Graded on the REST API with the hosted lines. Statuspage site at status.lokalise.com with five components and history back to 2022 (20). In the 90 days to 1 November 2026, a 42-minute search outage on 17 August marked critical (search only, partial), three hours of partial email delivery failures on 14 September, and on 21 October an emergency maintenance window, announced on the status page at 07:49 UTC for 14:00 to 15:00 and extended at 14:39, in which the application, the API and Lokalise Messages were offline from 14:00 until 15:30 UTC per the postmortem (16:00 per the completion post) to patch PHP CVE-2026-109618 and CVE-2026-109619. Maintenance announced on the status page before it starts isn't counted as an incident, as akeyless's 11 October window was read, so the record holds minor incidents only (20 of 30). Limits published as 6 requests a second per token and per IP and 10 concurrent requests per project (15). 429 is documented with advice to back off exponentially, and responses carry X-RateLimit-* headers, but no Retry-After is documented and writes take no idempotency key (9 of 15). The Master Service Agreement commits to 99.5 per cent a month with service credits, per the 8 October check, not re-read on 1 November (10). The REST API is generally available, while the MCP server and the new Vantage API are in beta (10). 20+20+15+9+10+10 = 84.

TranslatePlus 45

Hosted lines. status.translateplus.io is the vendor's own page; on 6 November 2026 it showed 'All systems unknown' and a last update of 22 January 2026, with data loading by script (5). No incident history to read (5). The rate-limits guide gives 100,000 requests a minute and 100,000,000 an hour per key, while llms.txt gives 50 requests a second on the Free plan, so limits are published but inconsistent (10). 429 returns a JSON detail message, responses carry X-RateLimit-Limit, -Remaining and -Reset, and the guide shows waiting for the reset with capped retries (15). No SLA. The terms say TranslatePlus strives for 99.9% uptime 'but do not guarantee uninterrupted service' (0). API v2 is the current, non-beta version (10). 5+5+10+15+0+10 = 45.

Lokalise 73

OAuth 2 with read and write scopes per resource, and personal API tokens that are read-only or read/write and revocable. Tokens never expire and carry all of the creating user's access, and the MCP server adds PKCE and dynamic client registration (26 of 30). Read-only tokens, scopes and role-based project permissions limit access, but no confirmation step was found for calls such as emptying a project (13 of 20). The API returns strings written by translators and contributors, and no guidance on untrusted content was found in the reviewed documentation (3 of 15). GET /v1/audit-logs returns team audit events in OCSF 1.3.0, and the security page says logs are kept 12 months (13 of 15). security.txt valid to 20 August 2027, a disclosure policy at vdp.lokalise.com, a private bug bounty on YesWeHack, SOC 2 Type II, ISO 27001 and ISO 27017 per the security page (18 of 20).

TranslatePlus 35

One API key per account in the X-API-KEY header, which the docs say 'carries full access to your account's resources', and can be revoked in the dashboard (15). No scopes or read-only keys (5). Translations return the caller's own text, so little untrusted content (10). llms.txt claims request logging and an analytics dashboard, which we couldn't see without an account (5). translateplus.io/.well-known/security.txt returns 404 and no disclosure policy was found; llms.txt says 'SOC 2 compliant' and 'SOC 2 Type II certified infrastructure' with no report or auditor named (0). 15+5+10+5+0 = 35.

Lokalise 81

Closed service with a published Master Service Agreement, and the CLI and SDKs under BSD 3-Clause (15). Privacy policy of March 2026 (still the date on 1 November), a DPA dated 21 March 2023, an AI statement and a sub-processor list. The agreement deletes inactive account data after 30 days. The privacy policy says customer data doesn't train general-purpose models, and the AI statement says it can train Lokalise's own models with consent. We did not read the DPA PDF (22 of 30). No deprecation policy found. The API changelog carries dated notices from 2021 and 2022, and the Developer Program Agreement allows changes to API access with or without notice (6 of 20). Sub-processors listed with purpose and location, updated 1 August 2026, and customer data hosted on AWS in EU regions (20).

TranslatePlus 52

Editorial half only. Closed service under terms last updated 18 December 2024 that name PetaBytes, Inc. as a US corporation but give no address, governing law or courts (10). The terms say translation requests aren't permanently stored 'unless required by law', the privacy policy says 'unless required for caching or service improvement purposes', and the terms allow using anonymised usage data to improve the service (8). API v1 is kept as legacy, with no dated deprecation notice (5). No subprocessor list or data location found (0). 10+8+5+0 = 23.

Lokalise 76

Three public OpenAPI 3.0.3 files, the default-projects one with 63 paths and 109 operations (25). llms.txt with 182 reference links and a Markdown twin of each page (10). Every operation has a description that names the admin right and OAuth scope it needs and which project types it works on, with little on when not to call it (14 of 20). 65 enums and required fields marked, but boolean flags are numbers 0 and 1 and many filters are comma-separated strings (9 of 15). 213 examples, but 108 of 109 operations document only the 200 response and the error list is one general page (8 of 15). The path is versioned at /api2 and there is a dated API changelog, whose newest entry is 29 May 2025 while later API changes appear only in the product changelog (10 of 15).

TranslatePlus 52

No OpenAPI or other machine-readable contract found in the docs or either llms.txt (0). llms.txt on the site and on docs.translateplus.io (10). Endpoint pages say what each call does, with little on when to choose HTML, email or i18n jobs over plain text (10). Required fields and per-plan character limits per request are documented, without enums for language codes beyond a supported-languages call (10). Code examples in several languages and an error-handling guide with status codes (12). Versioned /v1 and /v2 paths and a changelog, whose newest entry is 2.0.0 on 9 December 2024 (10). 0+10+10+10+12+10 = 52.

Lokalise 69

API reading of the checklist. include_translations, include_comments and similar flags and a limit size the responses, and the MCP server splits its tools into two toolkits of 22 and 16 documented actions (18 of 25). Page and cursor paging with X-Pagination-* headers and filters by tag, file name, platform and untranslated state (20). Errors carry a code and a message, and bulk calls return an error per failed item, but messages are short and codes are HTTP statuses only (13 of 20). No idempotency key was found in the OpenAPI files, and we could not read the MCP tool annotations without an account. File imports return a process to poll (4 of 20). Few required fields (one on a task, three on an upload) and official clients for Node, Python, Ruby and PHP plus a CLI written in Go (14 of 15).

TranslatePlus 61

API reading. Batch translation of up to 100 texts a call and separate HTML, email, subtitle and i18n job endpoints (16). Few output controls or filters (10). Errors are a detail string with HTTP status codes (12). No idempotency key for i18n jobs, though text translation is stateless (8). Official SDKs listed for Python, JavaScript and TypeScript, Java and PHP, with few required fields (15). 16+10+12+8+15 = 61.