Mixpanel vs Userpilot

Mixpanel 84

Closed service with public terms of use, last updated 2 June 2026. The SDKs are Apache-2.0 and Mixpanel Headless is MIT (16 of 30). The DPA of 2 June 2026 makes data available for 30 days after termination and then destroys it, and audit log retention is stated per plan. The privacy policy of 21 August 2026 covers only Mixpanel's own collection and names data centres in the US and EU, while the DPA adds India (24 of 30). Removals come with dated notices (Project Secret on 3 March 2027, TLS 1.0 and 1.1 in April 2026, US-to-EU forwarding in July 2026). No written policy with a minimum notice period was found (14 of 20). The sub-processor list, effective 21 October 2026, gives locations and names Anthropic, OpenAI and Google Vertex AI, with 30 days' notice of new sub-processors in the DPA (19 of 20).

Userpilot 59

A closed service with terms dated 23 April 2024 (15 of 30). The privacy policy of 11 March 2025 names a DPO and two sub-processors (AWS and Cloudflare), while the security page names AWS, Google Cloud and Stripe. The DPA is on request and no customer-data retention period is stated (14 of 30). No deprecation policy or dated API notices found (3 of 20). Sub-processors are named with addresses but not data locations, though an EU ingestion endpoint exists (10 of 20). 15+14+3+10 = 42.

Mixpanel 65

Read with the hosted lines, on the Query API and the hosted MCP server. www.mixpanelstatus.com is a Statuspage site with 11 components by region (20). Its history feed lists five incidents between 4 August and 2 November 2026. The Query API failed for US projects for about 77 minutes on 26 August, 2:02 to 3:19 PM PT per the post-mortem, when query servers "across the region failed their health checks nearly simultaneously" and reports were unavailable, with EU and India projects unaffected. US is the default data residency. A core API down across one region for an hour or more reads as a regional major, as vapi's US calls outage and google-drive-api's did. The others were confined to one host, tool or a subset and read as minor. Ingestion was delayed for US projects on 8 October, requests to decide.mixpanel.com failed on 21 October with the regional API hosts as a workaround, the MCP Get-Report tool failed with skip_results false on 6 August, and property menus misbehaved on 19 August. One major outage (10). Limits have numbers, 60 queries an hour and five concurrent on the Query API and 600 MCP requests an hour per user (15). The import docs give exponential backoff with jitter from 2 seconds to 60 for 429, 502 and 503, and $insert_id makes import retries safe. No Retry-After header was found in the reviewed documentation (12 of 15). No uptime SLA was found. Section 9.4 of the terms says the service isn't warranted to be always available (0). The APIs and the MCP server are generally available, with service account sign-in for MCP, the experiment and flag tools and Get-Audit-Log in beta (8 of 10). 20 + 10 + 15 + 12 + 0 + 8 = 65.

Userpilot 82

Graded on the hosted service with the hosted lines. Better Stack status page at status.userpilot.io with components for ingestion in three regions, the SDKs, the web application APIs and the website (20). From August to November 2026 the page shows only scheduled maintenance windows of two to four hours, with no incidents; the MCP server isn't a component (30). 600 requests a minute per token for the real-time APIs, but no numbers for MCP or export (12 of 15). 429 documented with exponential backoff guidance; no Retry-After or idempotency guidance (10 of 15). The SLA is a custom Enterprise contract term, not published (0). The MCP server is 1.0.0 in the registry with no beta label (10). 20+30+12+10+0+10 = 82.

Mixpanel 79

14 OpenAPI 3.0 and 3.1 specs are public at docs.mixpanel.com/openapi/ with 106 operations. The MCP tool schemas sit behind sign-in, so the API carries this line (25). llms.txt with about 530 links, llms-full.txt, a Markdown copy of every page and a docs MCP server (10). All 106 operations carry a summary or description, and the MCP page gives each tool one line with no guidance on when not to use it (15 of 20). The specs hold about 250 enums, but Query API calls pass JSON-encoded strings and where expressions in query parameters and JQL takes a script (10 of 15). Examples are present, the ingestion spec documents 400, 401, 413 and 429, and the Query spec documents only a 200 on all 19 operations (9 of 15). The changelog is public and dated with 183 entries. The APIs carry no dated versions, with paths such as /api/2.0 and /v1 (10 of 15).

Userpilot 71

Every API reference page embeds an OpenAPI 3.0 definition, though no standalone spec file was found (20 of 25). llms.txt and Markdown versions of every page (10). Endpoint pages state their purpose and the MCP docs say what each permission allows; the MCP tool definitions weren't read because that needs a session (12 of 20). Request bodies are typed, mostly as strings and string arrays with few enums (9 of 15). An error reference covers 400, 401, 422 and 429 with causes, and pages carry examples (12 of 15). /v1 paths and dated SDK release notes; no API changelog was found (8 of 15). 20+10+12+9+12+8 = 71.

Mixpanel 70

OAuth authorisation code with PKCE, dynamic client registration and 24 scopes for MCP. Service accounts are revocable, take a project role and can expire. The legacy Project Secret, one key for a whole project, stays valid on older projects until 3 March 2027 (26 of 30). Consumer and Analyst roles, custom roles on Enterprise, scope subsets and an organisation switch for MCP limit access. The MCP docs describe no read-only mode and no confirmation before Delete-Dashboard, Delete-Cohort or bulk edits (11 of 20). Event properties and replay data reach the model. The docs warn that data goes to the AI provider and give no prompt-injection guidance (3 of 15). MCP writes are logged with an origin of MCP on all plans for 90 days, with an audit log API and streaming on Enterprise. Reads and failed calls aren't logged (12 of 15). SOC 2 Type II, ISO 27001 and ISO 27701, a security.txt valid to 18 May 2027 and a private HackerOne programme. We didn't search NVD (18 of 20).

Userpilot 62

The MCP server uses OAuth with PKCE, dynamic client registration, revocation, separate read and write scopes and the user's own role. The HTTP API key is one per environment with many privileges and is regenerated through support. Averaged over both surfaces (22 of 30). Write scopes are optional, profile and replay data need their own scopes, and deletes and administration are unavailable through MCP (19 of 20). Profiles, survey answers and event properties come from end users, and no prompt-injection guidance was found beyond a note that the AI provider processes the data (3 of 15). Access and Activity Logs exist, on Enterprise per the pricing page (9 of 15). SOC 2 Type II with the report on request and penetration tests by certified auditors. No security.txt, disclosure policy or bug bounty (9 of 20). 22+19+3+9+9 = 62.

Mixpanel 37

Read with the hosted rubric. No x402, MPP or L402 (0). Prices are public without login. The docs give $0.00028 an event beyond the first 1M a month on the 1M Growth plan and the pricing page has a volume calculator. Enterprise is by quote, and the Query API limits on Free and Growth aren't given as figures (17 of 20). The Free plan covers 1M events a month with no card (20). A person signs up in a browser and approves OAuth or creates a service account. The MCP server supports dynamic client registration, but a user still signs in (0).

Userpilot 30

No x402, MPP or L402 (0). Plan prices are public ($299 and from $849 a month), with no per-unit prices (10). 14-day free trial with no card required (20). Signup and OAuth approval happen in a browser (0). 0+10+20+0 = 30.