MapTiler Cloud vs Radar

MapTiler Cloud 40

No x402, MPP or L402 (0). Per-1,000 prices for requests ($0.15) and sessions ($2.50) public without login (20). Free plan with no card, though only for testing and non-commercial use (20). Signup is a browser flow (0). 0+20+20+0 = 40.

Radar 10

No x402, MPP or L402 (0). The pricing page publishes starting prices without a login, $0.50 per 1,000 calls for Core Maps and $2.00 for Premium Maps, but every plan is an annual commitment at a rate set by quote (10). The pricing page says "Radar does not currently offer a free tier", and the technical validation period goes through sales (0). Keys come from a dashboard account, and the sign-up page was closed to us by robots.txt on 9 October, so no programmatic route was found (0). 0 + 10 + 0 + 0 = 10.

MapTiler Cloud 79

OpenAPI 3.1.0 document with 32 paths for the public APIs (25). llms.txt, llms-full.txt and a Markdown twin of every page (10). Each API page says what it's for and when to use the SDK instead (session billing), with little on when not to call it (13). Parameters are typed with defaults, such as limit (default 5 forward, 1 reverse) and a types enum, but bbox and proximity are strings (11). Examples on every endpoint, and the spec documents 400, 403, 404 and 414, without an error reference page (10). A dated platform updates page and a geocoding index changelog, but no version in the API path and the spec is version '1.0' (10). 25+10+13+11+10+10 = 79.

Radar 50

No OpenAPI description or other machine-readable contract was found in the docs index (0). docs.radar.com publishes llms.txt and a Markdown twin of each page, with the whole API reference in one Markdown file of about 154 KB (10). Descriptions say what an operation is for and sometimes when to use another, for example forward geocoding for complete addresses and autocomplete for partial ones (14). Parameters are listed with type, required or optional, ranges and allowed values, though coordinate lists travel as pipe-delimited strings and there is no schema to validate against (11). Every operation has a sample request and response, and there is one list of 12 response codes with one sample error (11). Paths carry /v1, and no API changelog was found (4). 0 + 10 + 14 + 11 + 11 + 4 = 50.

MapTiler Cloud 43

Hosted lines. status.maptiler.com is a StatusCake public uptime report rather than a component incident page (15). Its data loads from app.statuscake.com, whose robots.txt answered with a redirect, so we didn't fetch it and read no history. That's our limit, not a finding, and the rubric gives 5 (5). Monthly request and session quotas are published per plan, but no per-second limit (5). No 429, Retry-After or backoff guidance found in the API reference, the OpenAPI spec or llms-full.txt (0). The pricing page lists a 99.9% SLA on the Custom plan, while the Cloud terms call availability best effort and point to a custom SLA (8). The public APIs are GA (10). 15+5+5+0+8+10 = 43.

Radar 70

Read with the hosted lines. status.radar.com is a Statuspage site with components for the Geocoding, Search, Routing, Maps, Track and Trips APIs among others (20). Its history feed lists two incidents in the 90 days to 4 November 2026. Elevated API errors on 27 August from 19:31 to 20:34 EDT, and elevated API latencies on 23 October from 11:52 to 14:57 EDT, traced to a Cloudflare incident. Neither states the share of failed requests, and this run reads "elevated" errors or latencies as partial, so both are minor (20). Each operation states a default rate limit, 100 requests a second for geocoding down to 10 for matrix and the data operations (15). 429 is documented with three meanings, with no Retry-After header or backoff guidance found, and PUT upserts keyed on tag and externalId make geofence writes repeatable (5, partial kept). No SLA is published (0). The APIs carry no beta label (10). 20 + 20 + 15 + 5 + 0 + 10 = 70.

MapTiler Cloud 80

Editorial half only. Closed service with general and Cloud-specific terms under Swiss law, and SDKs under BSD 3-Clause and the skill under MIT (20). The privacy policy covers account and payment data and says legal-claim data is kept up to 10 years, but says nothing about how long API request logs are kept (15). A dated deprecation page for v3 maps and migration guides, with no written notice period (12). Hosting with OVHcloud and Google Firebase, data mainly in Switzerland and the EEA, and an EU-only endpoint. Google Analytics, Firebase and FastSpring named in the privacy policy (17). 20+15+12+17 = 64.

Radar 55

Closed service with public Terms of Use, and an Apache-2.0 web SDK. The terms date from 24 May 2023, describe a free version the pricing page says does not exist, and paid plans run on a quoted agreement that is not published (12). The privacy notice of 13 May 2025, a public DPA and the FAQ agree on a default retention of 1 year, with 90 days for trips and 7 days for location updates in the FAQ. The privacy notice itself gives no period (22). No deprecation policy was found, and the terms let Radar change or stop the services without notice. One parameter (userId on geofences) is marked deprecated with no date (2). The DPA names AWS and MongoDB as sub-processors, and the privacy notice says hosting is in the United States (15). 12 + 22 + 2 + 15 = 51. The privacy notice and DPA weren't re-read on 4 November, so their readings are per the 9 October check.

MapTiler Cloud 64

Revocable keys that can be limited to origins and a User-Agent substring and managed by the API keys API, and service tokens that sign requests so the token itself never travels, which earns 27. Less 10 because the key is 'always passed as a query parameter' (17). The public APIs are read-only, and account changes need a separate service token (16). Geocoding returns OpenStreetMap names and addresses, community-edited text, with no prompt-injection guidance (7). An Analytics API and account usage statistics (8). security.txt, a vulnerability disclosure policy and ISO/IEC 27001:2022 certification per the security page. No bug bounty found (16). 17+16+7+8+16 = 64.

Radar 56

Four keys a project, test and live, publishable and secret, sent in the Authorization header only. A secret key can read or write any data and no scopes were found. Key rotation was not read (20). Publishable keys reach only 16 of the 38 documented operations and can be restricted by website domain or mobile app identifier, and dashboard accounts have read, write, admin and owner roles. No confirmation step for deletes (10). Results are addresses and place names from open and commercial datasets, with no prompt-injection guidance (6). Audit logs cover dashboard requests on enterprise plans, and each API response has a request ID (7). security.txt answers 404 (4 November 2026). The FAQ gives a disclosure address, and the DPA states SOC 2 Type II, a yearly third-party penetration test and a bug bounty, with the report on request. The trust centre is script-drawn and was not read (13). 20 + 10 + 6 + 7 + 13 = 56.

MapTiler Cloud 70

@maptiler/client 3.1.0 and @maptiler/sdk 4.2.0 on 2 October 2026, 35 days before this check, with the agent skill updated on 21 October (20). Platform updates entries for August (EU endpoint, key security) and September 2026 (terrain blending) plus the two October releases (20). A Discord community and support answered on a best-effort basis within two business days, per the Cloud terms. We didn't read GitHub issues (10). Official JavaScript client and SDK current, no Python client (12). The SDK repository runs unit and end-to-end tests in CI; we didn't check results (8). 20+20+10+12+8 = 70.

Radar 77

No API changelog was found, so recency rests on Radar's own SDKs. radar-sdk-android 4.2.0 on 29 October and radar-sdk-ios 3.45.0 on 27 October 2026, and in the listed web SDK, maps-v1.2.0 on 13 October (a MapLibre upgrade with changes to RadarMap.ts and RadarMarker.ts), all within 30 days (30). Stable tags in the 90 days from 6 August include web v5.1.2 (25 August), v5.1.3 (31 August), v5.2.0 (1 September), autocomplete-v1.1.1 (14 September) and maps-v1.2.0, iOS 3.40.0 to 3.45.0 and Android 3.37.0 to 4.2.0; betas aren't counted (20). No public changelog for the API, support through a customer success manager and a feedback form, and GitHub issue replies were not read (5). Official SDKs for eight platforms are current (15). The web SDK repository carries Jest tests and CodeQL and npm publish workflows, whose results were not read (7). 30 + 20 + 5 + 15 + 7 = 77.