Nominatim vs Radar

Nominatim 60

Self-hosted rule. No payment protocol (0). Free software with nothing to buy (20 + 20 + 20). The public instance is also free and keyless, within its usage policy. 0+20+20+20 = 60.

Radar 10

No x402, MPP or L402 (0). The pricing page publishes starting prices without a login, $0.50 per 1,000 calls for Core Maps and $2.00 for Premium Maps, but every plan is an annual commitment at a rate set by quote (10). The pricing page says "Radar does not currently offer a free tier", and the technical validation period goes through sales (0). Keys come from a dashboard account, and the sign-up page was closed to us by robots.txt on 9 October, so no programmatic route was found (0). 0 + 10 + 0 + 0 = 10.

Nominatim 60

Release 5.3.3 on 14 October 2026, 23 days before this check (30). Only one release in the 90 days from 8 August, against 106 commits on the default branch; commits aren't counted as releases (0). Commits from the lead maintainer and seven or more contributors since August, but we couldn't read issue reply times (12). The nominatim-api Python library is current with the server (10). CI on every push, current PostgreSQL and Python versions (8). 30+0+12+10+8 = 60.

Radar 77

No API changelog was found, so recency rests on Radar's own SDKs. radar-sdk-android 4.2.0 on 29 October and radar-sdk-ios 3.45.0 on 27 October 2026, and in the listed web SDK, maps-v1.2.0 on 13 October (a MapLibre upgrade with changes to RadarMap.ts and RadarMarker.ts), all within 30 days (30). Stable tags in the 90 days from 6 August include web v5.1.2 (25 August), v5.1.3 (31 August), v5.2.0 (1 September), autocomplete-v1.1.1 (14 September) and maps-v1.2.0, iOS 3.40.0 to 3.45.0 and Android 3.37.0 to 4.2.0; betas aren't counted (20). No public changelog for the API, support through a customer success manager and a feedback form, and GitHub issue replies were not read (5). Official SDKs for eight platforms are current (15). The web SDK repository carries Jest tests and CodeQL and npm publish workflows, whose results were not read (7). 30 + 20 + 5 + 15 + 7 = 77.

Nominatim 82

Read with the local-software lines, since the listing is the Nominatim server an operator runs. The public instance at nominatim.openstreetmap.org belongs to the OpenStreetMap Foundation and its usage policy caps it at one request a second, so it isn't graded as a hosted service. Official packages nominatim-db and nominatim-api on PyPI (5.3.3 on 14 October 2026, Python 3.9 or later) and installation guides for Ubuntu 22 and 24 (20). A public CI workflow runs unit and BDD tests on every push across Ubuntu 24 and 26 with PostgreSQL 13 to 18, and Windows unit tests. We couldn't see run results (20). Issue counts and reply times couldn't be read because the GitHub API was rate-limited for us; Sarah Hoffmann made 76 of the 106 commits since 8 August (12). A ChangeLog per release and semantic version numbers (15). Version 5.3.3 (15). 20+20+12+15+15 = 82.

Radar 70

Read with the hosted lines. status.radar.com is a Statuspage site with components for the Geocoding, Search, Routing, Maps, Track and Trips APIs among others (20). Its history feed lists two incidents in the 90 days to 4 November 2026. Elevated API errors on 27 August from 19:31 to 20:34 EDT, and elevated API latencies on 23 October from 11:52 to 14:57 EDT, traced to a Cloudflare incident. Neither states the share of failed requests, and this run reads "elevated" errors or latencies as partial, so both are minor (20). Each operation states a default rate limit, 100 requests a second for geocoding down to 10 for matrix and the data operations (15). 429 is documented with three meanings, with no Retry-After header or backoff guidance found, and PUT upserts keyed on tag and externalId make geofence writes repeatable (5, partial kept). No SLA is published (0). The APIs carry no beta label (10). 20 + 20 + 15 + 5 + 0 + 10 = 70.

Nominatim 75

API reading. limit, addressdetails, extratags, namedetails and the polygon options size responses, and geocodejson, geojson and jsonv2 formats are available (22). countrycodes, viewbox, bounded, layer, featureType and exclude_place_ids filter results, the last one standing in for pagination (18). Bad parameters return an error rather than a silent default in current versions, but there's no error code reference (12). Every endpoint reads and is safe to retry (15). Few required parameters, and the Python library exposes the same search API in-process, but there are no other official clients (8). 22+18+12+15+8 = 75.

Radar 65

Read as an API. limit on search operations (1 to 100), layers and country filters on geocoding, and optional geometry on route optimisation size a response, with no field selection (14). List operations page with limit up to 1,000 and date cursors such as updatedBefore (16). Errors are JSON with code, param and message, and every response carries X-Radar-Request-ID (15). The maps operations only read. Geofence and beacon writes are PUT upserts by external ID, and no idempotency key was found for trip or user creation (10). Most maps calls need one parameter. Official SDKs cover web, iOS, Android and five cross-platform frameworks, all client-side, with no server library found (10). 14 + 16 + 15 + 10 + 10 = 65.

Nominatim 50

The server has no authentication of its own; an operator puts it behind their own proxy. The public instance takes no key and identifies callers by User-Agent or Referer (5). Every endpoint reads, so there's nothing to approve (18). Results are OpenStreetMap names and tags, community-edited text, with no prompt-injection guidance (7). Query logging to a file is available through NOMINATIM_LOG_FILE and off by default (8). SECURITY.md gives security@nominatim.org, an acknowledgement within 3 work days, a disclosure process and two years of security updates per release. No bug bounty (12). 5+18+7+8+12 = 50.

Radar 56

Four keys a project, test and live, publishable and secret, sent in the Authorization header only. A secret key can read or write any data and no scopes were found. Key rotation was not read (20). Publishable keys reach only 16 of the 38 documented operations and can be restricted by website domain or mobile app identifier, and dashboard accounts have read, write, admin and owner roles. No confirmation step for deletes (10). Results are addresses and place names from open and commercial datasets, with no prompt-injection guidance (6). Audit logs cover dashboard requests on enterprise plans, and each API response has a request ID (7). security.txt answers 404 (4 November 2026). The FAQ gives a disclosure address, and the DPA states SOC 2 Type II, a yearly third-party penetration test and a bug bounty, with the report on request. The trust centre is script-drawn and was not read (13). 20 + 10 + 6 + 7 + 13 = 56.