Massive (formerly Polygon.io) vs TickerLayer

Massive (formerly Polygon.io) 67

Closed service under business terms last updated 6 October 2026, Massive.com, Inc. under Georgia law, which now also cover pay-per-request purchases without an account. The MCP server and clients are MIT (15). Privacy policy last updated 22 March 2024, with retention 'as long as we are providing the Services' and no periods. The business terms require deleting data on termination. No DPA found (12 of 30). Dated sunsets in the changelog. The terms let Massive change the Services at its discretion, with a 30-day route to report a change that materially degrades a subscribed service (10 of 20). Stripe, Google and Hotjar are named, and data may sit 'in the United States and locations around the world'. No subprocessor list (8 of 20).

TickerLayer 38

The editorial half. A closed service whose terms of use, user agreement and market data disclaimer (all effective 3 November 2026) set out internal, commercial and redistribution rights by plan and a liability cap. They name no legal entity, address or governing law, so the contracting party is unknown. The plugin and npm client are MIT. Soldfetch took 10 in the same position (10 of 30). The privacy policy keeps WebSocket connection records for 7 days but gives no period for request and tool-call logs or account data after closure, says nothing on model training, names no transfer mechanism and has no DPA (12 of 30). No deprecation policy. The terms allow MCP tools to change 'with reasonable notice where practical' and the user agreement promises notice before a plan is materially reduced, and the changelog records changes after the fact. Kite took 4 (4 of 20). Subprocessors are given only as categories (hosting, authentication, card and crypto payments, email, an AI model for support replies), with analytics vendors deferred to the cookie policy, no data locations, and no named data suppliers (4 of 20). 10+12+4+4 = 30. The provenance half is computed from the provenance block.

Massive (formerly Polygon.io) 35

A plain account key with no scopes, sent as a Bearer header or as ?apiKey= in the query string, a documented option (20 less 10, so 10). The x402 route at agent.massive.com needs no key. Read-only market data with no write actions (15 of 20). The x402 set includes news and SEC filing text written by third parties, and we found no guidance on treating it as untrusted (5 of 15). Paid x402 calls leave an on-chain USDC transfer. We found no request log documented for keyed callers (5 of 15). security.txt returns 404, and the terms and privacy policy name no SOC 2, ISO 27001, bug bounty or disclosure policy, only safeguards 'consistent with general industry standards' (0 of 20).

TickerLayer 49

A plain account key with no scopes, shown once and replaced by regenerating it in the dashboard (20). The OpenAPI file defines an apiKey query parameter as a 'compatibility fallback', and the WebSocket takes the key only in its URL, so 10 off. The MCP server adds OAuth 2.1 with PKCE S256, dynamic registration, refresh tokens, a revocation endpoint and one scope, market.read. Twelve-data took 18 on the same pattern, one less here because the WebSocket has no header option (17 of 30). Every operation reads data, and the OAuth scope is read-only, as for twelve-data and financial-datasets (15 of 20). Responses are prices, bars, symbols, calendars and yields. There is no news feed, and SignalPoint signals are structured fields, so no untrusted text reaches the agent (10 of 15). Rate-limit headers on every response, quota 429s that state the limit and when it renews, and a dashboard list of WebSocket connections with source IP, key and how each ended (24 October 2026). No per-call REST log for the key holder was found, though the privacy policy says request logs are kept (7 of 15). security.txt answered a client error, and no disclosure policy, bug bounty, SOC 2 or ISO 27001 was found (0 of 20). 17+15+10+7+0 = 49.

Massive (formerly Polygon.io) 78

Atlassian Statuspage at massive-status.com with REST, WebSocket and flat-file components for each asset class (20). The history feed lists 14 unplanned incidents from 3 August to 1 November 2026, each limited to one product, one endpoint, one asset class or some accounts. They include US equity aggregate bars missing for roughly two-thirds of US equities from 18:46 ET on 8 September until 10:29 the next day, stale stocks quotes on 20 August, and slow responses with intermittent 502s on stocks v2 aggregates from 10:37 to 13:08 ET on 2 September. The newest, on 27 October, was delayed WebSocket data and REST errors for some accounts from 13:49 to 14:17 EDT. Read the way partial incidents are read on other listings, that is minor incidents only (20). Free plan limited to 5 calls a minute, paid plans unlimited, nothing stated for x402 (10 of 15). No 429 or Retry-After guidance found in the docs or the OpenAPI file, though the official Python client retries 429 with backoff (8 of 15). The business terms dated 6 October 2026 point to a separate Support Policy and SLA document for customers who buy service levels (10). The REST API is generally available (10).

TickerLayer 70

Read with the hosted lines, on the REST API. status.tickerlayer.com is an UptimeRobot page linked from the site header (20). Its monitors and history load by script from /api/, which its robots.txt disallows, so no incident record was read, as for eodhd and apitemplate-io (5). Limits are published with numbers, 10 requests a second per account on Free and Individual, 100 on Business, and monthly call quotas per feed (15). The OpenAPI file's 429 carries Retry-After and a body with retryAfterMs, resetsAt and a code that separates the per-second limit from the monthly quota, and every response has carried X-RateLimit-Limit and X-RateLimit-Remaining since 14 September 2026. Every data operation is a GET, and x402 retries with the same payment identifier return the stored response (15). An SLA is named only for Enterprise under a written agreement and as 'partially available' on Business, with no published terms or figure, and the terms of use promise no uptime. Financial-datasets took 10 for SLAs listed on a self-serve plan, so this is half (5 of 10). No beta or preview label on the REST API, the MCP server or the x402 gateway (10). 20+5+15+15+5+10 = 70.