Tailscale built its Aperture AI model router on Vercel's AI Gateway

Tailscale routes customer AI access through Vercel

Tailscale, the company behind the identity-based private network known as a tailnet, has detailed how it built Aperture, its customer-facing AI model router, on top of Vercel's AI Gateway and Vercel Sandbox rather than constructing the plumbing in-house. According to a case study published on the Vercel blog, the choice took the product from prototype to paying customers in a matter of months.

Model access follows network identity

Aperture extends Tailscale's networking model to AI. Instead of issuing a separate provider API key to every employee, agent, or tool, a company controls model access through tailnet membership: anyone added to the network can immediately use approved models, and access disappears the moment they are removed.

Under the hood, Aperture relies on AI Gateway as one API spanning hundreds of models and on Vercel Sandbox as an isolated place for agents to run. Together, the two services let Tailscale sell model access and agent execution inside a customer's private network without assembling every piece of AI infrastructure itself.

Why Tailscale skipped building it in-house

Tailscale is an infrastructure company, so building the routing and execution layers itself was the obvious first option, until the team looked closely at the work involved. Remy Guercio, who leads product for Aperture, notes that provider endpoints look interchangeable from the outside but behave differently in practice.

David Carney has direct evidence: Tailscale still maintains hand-built plumbing for a few customers who have not migrated to Aperture. He describes the complexity as extreme, citing basics that major providers omit, such as returning the cost of a request in the response.

Agents raised the stakes further. An agent that can read private data, act on what it reads, and reach the public internet forms what security practitioners call the "lethal trifecta", and the recommended mitigation is an isolated sandbox with identity and access controls built in. Carney says Tailscale could not have shipped Aperture if it had also tried to build that sandbox itself.

Zero data retention and no markup

Because Tailscale's customers care about protecting their data, zero data retention was a baseline requirement for Aperture. The Vercel blog lists the reasons the company picked AI Gateway: the gateway itself retains no data, and ZDR can be enforced globally or per request via a zeroDataRetention flag that restricts routing to compliant providers. Carney points out that which models actually offer ZDR keeps shifting, and having the gateway handle that logic removes a maintenance burden from Tailscale.

Pricing was another factor. AI Gateway adds no markup to token costs on any provider or model, including when customers bring their own keys, so Aperture users pay the same rates they would pay going direct. The gateway also returns cost and usage on every request, which lets Aperture surface spend to customers without Tailscale maintaining price tables for each provider.

Agents run sandboxed, without keys

The agent workflow runs entirely on tailnet identity: a sandbox spins up and connects to Aperture, Aperture connects to AI Gateway, Tailscale validates the identity, the agent does its work, and the sandbox shuts down. No key is ever handed to the agent.

Tailscale also shopped the sandbox layer, and according to Guercio it had a full working implementation on another provider before switching, on the grounds that the team wanted to spend its effort on network identity rather than sandbox security boundaries.

Tailscale migrated itself first

Tailscale's own internal AI usage had grown the way most companies' does: a patchwork of direct provider accounts and cloud endpoints accumulated team by team. Even after requests moved through Aperture, the proxy was still calling providers directly behind the scenes.

After wiring customers onto AI Gateway, Tailscale's engineers added a switch in Aperture that pointed requests at the gateway instead of the individual provider APIs, collapsing many integrations into one. Guercio says the whole company was cut over in seconds, every model employees already used was in the gateway catalog, and nobody noticed the change. Tailscale now presents its own migration as the playbook for enterprise customers juggling dozens of provider accounts and keys.

What's next

Aperture started as a raw gateway for engineers to point a coding agent at. It now includes a chat interface, MCP connectors, and sandboxes that launch as ephemeral tailnet nodes. The next target Carney describes is "time to first app": a user signs up, runs a prompt, builds an app, and shares it within ten minutes. His advice to other companies is to focus on the product they deliver rather than the infrastructure underneath it, arguing that most teams do not need to build another router.

Why it matters

This is a production data point in the debate over whether teams should build their own AI routing layer. Tailscale, a company whose entire business is infrastructure, looked at provider fragmentation, shifting zero-data-retention guarantees, and agent sandboxing, and concluded that the undifferentiated plumbing was not worth owning. It is worth remembering that the post is a vendor case study published by Vercel, so claims about latency and sandbox quality come from the vendor and its customer. Even so, the architecture is a reusable pattern for anyone exposing models to customers or internal agents: make network identity the access boundary, never hand keys to agents, and surface cost per request instead of maintaining provider price tables by hand.