How Tailscale built a customer-facing model router on AI Gateway

Tailscale’s Aperture extends the company’s tailnet concept—already used to unify devices and cloud resources—into AI infrastructure. Instead of managing separate API keys for each model provider, Aperture routes requests through a single API, enabling companies to grant or revoke model access by adding or removing users from the tailnet itself. This approach simplifies administration while maintaining security, as access controls are tied directly to network identity rather than individual provider credentials.

Aperture relies on Vercel AI Gateway for routing and Vercel Sandbox for secure agent execution, eliminating the need for Tailscale to build these layers internally. The decision followed an assessment of the engineering complexity involved in managing diverse provider endpoints, which Tailscale had previously handled for legacy customers. AI Gateway also provides cost transparency by embedding pricing data in responses, a feature Tailscale found absent in many provider APIs, further reducing operational overhead.

Zero data retention (ZDR) was a critical requirement for Aperture, as Tailscale’s customers prioritize data privacy. AI Gateway supports ZDR through global or per-request flags, automatically restricting routing to compliant providers without requiring Tailscale to maintain separate logic. This ensures that model interactions do not retain customer data, aligning with enterprise security policies while simplifying compliance management.

The partnership with Vercel accelerated Tailscale’s development timeline, enabling the team to move from prototype to paying customers in months. By migrating their own internal AI requests to AI Gateway, Tailscale reduced integration complexity from dozens of provider accounts to a single interface, a model they now replicate for enterprise customers seeking to consolidate fragmented AI infrastructure.