Customers get model access through tailnet identity

Tailscale's core product links laptops, servers, cloud instances and personal devices into one private network called a tailnet. Aperture by Tailscale applies that pattern to AI: rather than handing out a provider API key to each employee, agent or tool, access to models is governed by the tailnet. Someone added to the network can immediately use approved models; someone removed from it loses that access.

Remy Guercio, who leads product for Aperture, describes the underlying network as "basically like a VPC that can span any cloud, on-prem, your house, and your phone." Hundreds of AI models are shipped to customers inside the product this way, and the team went from a model routing prototype to paying customers in months.

Why the routing layer wasn't worth rebuilding

As an infrastructure company, Tailscale's default instinct was to build routing and execution itself. A closer look at the engineering cost changed that. Provider APIs look uniform from the outside — "You would think all of the endpoints are the same," Remy says — but they are not.

David Carney, Co-founder and Chief Strategy Officer, still maintains that plumbing for customers who haven't moved to Aperture, and he considers the gateway's handling of basics telling: "There are a lot of things the big providers don't do that blow my mind that the gateway does, like simply putting the cost in the response. We initially built those systems for customers ourselves, and the complexity is insane."

Agents added a second problem. An agent able to read private data, act on what it reads and reach the public internet forms what is now called the "lethal trifecta." The mitigation is an isolated sandbox with identity and access controls built in. "I think we wouldn't have been able to deliver the product if we were also trying to build a sandbox ourselves," David says.

ZDR and a custom router on AI Gateway

Aperture runs on Vercel AI Gateway and Vercel Sandbox: one API for hundreds of models, plus a safe place for agents to execute, so customers get model access and agent execution inside their private network without assembling the AI infrastructure themselves. Tailscale evaluated the routing layer broadly — "We did talk to a lot of other folks, including providers themselves, and Vercel just made it very easy," Remy says.

Cost visibility was part of the appeal: AI Gateway returns cost and usage on every request, so Aperture can show spend to customers without keeping price tables per provider. Zero data retention was non-negotiable for a customer base that cares about data protection, and drove the choice on two points:

  • AI Gateway retains no data itself.
  • ZDR can be set globally, or per request with the zeroDataRetention flag, which restricts routing to ZDR-compliant providers automatically.

"All this ZDR stuff is a moving target, like, which models have zero data retention versus not," David says, "but we don't have to write any of that logic, because it's all handled for us." Token costs are not marked up on any provider or model, including when Tailscale's customers bring their own keys, so they pay the same rate as going direct.

Agents, sandboxes, and a five-step loop

With model access settled, the work shifted to running agents safely on a tailnet. The workflow: a sandbox spins up and connects to Aperture; Aperture connects to AI Gateway; Tailscale validates the identity; the agent does its work; the sandbox shuts down. No key is ever issued to the agent.

The sandbox layer was shopped too. Tailscale had a working implementation on another provider and still switched. "We wanted to focus on network identity, not sandbox security boundaries, and Vercel's sandboxes are bulletproof," Remy says. "We tried many different sandbox providers and even had a full implementation on one, and still switched to Vercel. It was shockingly easy for us to switch everything over."

Migrating Tailscale's own providers to the gateway

Tailscale's internal AI traffic had accumulated the way it does at most companies: direct provider accounts and cloud endpoints added team by team. Those requests already passed through Aperture, but behind the proxy they still hit separate providers. After building on AI Gateway for customers, Tailscale turned the migration on itself.

An engineering switch in Aperture was pointed at AI Gateway instead of individual provider APIs, collapsing many integrations into one. Employees saw nothing change — Aperture remained the endpoint they called, and every model already in use was in the AI Gateway catalog, so the cutover caused zero interruption. Tailscale now uses its own migration as the playbook for enterprise customers juggling dozens of provider accounts and keys: "We were able to cut the entire company over to using AI Gateway in seconds, and nobody noticed. That was the exciting part. Nobody noticed."

Two meanings of time to first token

Asked what Vercel is worth to Aperture, David answers "time to first token." Remy notes that David overloads the phrase: in AI infrastructure it means how long it takes to load the cache, generate a response and deliver it to the user, whereas David means the time from user signup to their first model call — the time-to-value Aperture sells. "I constantly push the team to remove the most barriers possible to get someone to that wow moment as fast as we can," David says. "After months of testing different products, Vercel was the answer to the infrastructure side, because AI Gateway has such low latency."

From gateway to platform, and the next ten minutes

Aperture began as a raw gateway engineers could point a coding agent at. It now includes a chat UI, MCP connectors, and sandboxes launchable as ephemeral nodes, all running on tailnet identity. "Aperture has turned into a single place for our customers' AI access, not just a developer tool."

The new target is time to first app: David wants a user to sign up, run a prompt, build an app and share it in ten minutes or less. "We don't exactly know what that's going to look like, but we know we're going to have to iterate quickly," Remy says. "Having partners you can work with hand in hand on that is incredibly important." David's guidance to other companies is to spend effort on the product customers receive rather than the infrastructure beneath it: "A lot of people want to build their own router. And look at us, we tried to do it too. But you don't need to build another router."