How Tailscale built a customer-facing model router on AI Gateway

Tailscale built Aperture, its customer-facing AI model router, on Vercel AI Gateway and Vercel Sandbox, giving customers access to hundreds of AI models routed through their private tailnet network. Remy Guercio, who leads product for Aperture by Tailscale, said the company went "from prototype to paying customers in months on Vercel" after deciding not to build the routing and sandbox layers in-house. AI Gateway provides one API across hundreds of models, returns cost and usage on every request, and supports zero data retention globally or via a per-request `zeroDataRetention` flag, with no markup on token costs.

Hundreds of AI models shipped to customers in-product Model access granted and revoked by tailnet network identity Went from model routing prototype to paying customers in months Tailscale connects a company's laptops, servers, cloud instances, and personal devices into one private network called a tailnet. Remy Guercio, who leads product for Aperture by Tailscale, describes it simply: "It's basically like a VPC that can span any cloud, on-prem, your house, and your phone." Aperture takes that same idea and applies it to AI. Instead of giving every employee, agent, or tool a separate provider API key, Aperture lets companies control model access through the tailnet itself. Add someone to the network, and they can immediately use approved models. Remove them, and access disappears. Under the hood, Aperture is built on Vercel AI Gateway https://vercel.com/ai-gateway and Vercel Sandbox https://vercel.com/sandbox . AI Gateway gives Tailscale one API for hundreds of models. Sandbox gives agents a safe place to run. Together, they let Tailscale offer model access and agent execution inside a customer's private network, without their team building every piece of AI infrastructure from scratch. Tailscale is an infrastructure company, so building the routing and execution layers in-house was the obvious first option. But once they took a deeper look into the engineering effort required, they chose not to. The provider layer looked deceptively simple from the outside. "You would think all of the endpoints are the same," Remy says. "They are not." David has the receipts, because Tailscale still maintains that plumbing for a few customers who haven't migrated to Aperture yet. "There are a lot of things the big providers don't do that blow my mind that the gateway does, like simply putting the cost in the response," he says. "We initially built those systems for customers ourselves, and the complexity is insane." Agents raised the stakes further. An agent that can read private data, act on the text it reads, and reach the public internet is a security problem now called the "lethal trifecta." The right mitigation is an isolated sandbox with identity and access controls baked in. "I think we wouldn't have been able to deliver the product if we were also trying to build a sandbox ourselves," David says. "But we were able to go from prototype to paying customers in months on Vercel." Tailscale shopped the routing layer first. "We did talk to a lot of other folks, including providers themselves, and Vercel just made it very easy," Remy says. AI Gateway gives Aperture one API across hundreds of models, and returns cost and usage on every request, so Aperture can surface spend to customers without Tailscale maintaining price tables for each provider. Tailscale's customers care about protecting their data, and Zero data retention https://vercel.com/docs/ai-gateway/security-and-compliance/zdr ZDR was table stakes for Aperture. Tailscale chose AI Gateway because: The AI Gateway itself retains no data. They can set ZDR globally or use the per-request zeroDataRetention flag, which automatically restricts routing to ZDR-compliant providers. "All this ZDR stuff is a moving target, like, which models have zero data retention versus not," David says, "but we don't have to write any of that logic, because it's all handled for us." AI Gateway doesn't mark up token costs on any provider or model, including when Tailscale's customers bring their own keys. Aperture's customers pay the same rate they would going direct, across every model in the catalog. Ask David what Vercel is worth to Aperture, and his answer is simple: time to first token. But that means something different to David than it does to Remy, and both are right. " David Carney likes to overload the term time to first token ," Remy says. "In the AI infrastructure world it has a very specific meaning, which is how long it takes to load the cache, generate the response, and deliver it back to the user." Remy explains David's definition: "It's the time from user signup to their first model call, which is the real value Aperture provides to our customers." And Aperture's success is measured by that time-to-value. "I constantly push the team to remove the most barriers possible to get someone to that wow moment as fast as we can," David says. "After months of testing different products, Vercel was the answer to the infrastructure side, because AI Gateway has such low latency." Once Aperture had model access in place, the team focused on making it safe to run agents inside a tailnet. This is the workflow: A sandbox spins up and connects to Aperture. Aperture connects to AI Gateway. Tailscale validates the identity. The agent does its work. The sandbox shuts down. No key is ever issued to the agent. Tailscale shopped the sandbox layer too, and even had a working implementation on a different provider before deciding to switch. "We wanted to focus on network identity, not sandbox security boundaries, and Vercel's sandboxes are bulletproof," says Remy. Tailscale's own AI usage had grown the way most companies' has: a mix of direct provider accounts and cloud endpoints, accumulated one team at a time. Internally, those requests went through Aperture, but behind the proxy, it was still calling separate providers directly. After implementing AI Gateway for their customers, they knew they wanted to make the migration themselves. Tailscale's engineering team built a switch in Aperture that pointed requests to AI Gateway instead of the individual provider APIs, so now they have one integration rather than separate ones for each provider. Nothing changed for employees. Aperture was still the endpoint they called, and every model they were already using was in the AI Gateway catalog, so the cutover happened with zero interruption. Tailscale now uses their own migration as the playbook for enterprise customers juggling dozens of provider accounts and keys. Aperture started as a raw gateway for engineers to point a coding agent at. It now has a chat UI, MCP connectors, and sandboxes launchable as ephemeral nodes, all running on tailnet identity. Aperture's new goal is time to first app. David wants users to sign up, run a prompt, build an app, and share it, all in ten minutes or less. "We don't exactly know what that's going to look like, but we know we're going to have to iterate quickly," Remy says. "Having partners you can work with hand in hand on that is incredibly important." David's advice to other companies is to focus on the product they deliver to customers, not the infrastructure required to run it. "A lot of people want to build their own router. And look at us, we tried to do it too," he says. "But you don't need to build another router." About Tailscale https://tailscale.com/ : Tailscale is a secure connectivity platform that connects a company’s users, devices, servers, cloud infrastructure, and services through an identity-based private network. Their model router, Aperture by Tailscale, extends that network to AI models and agents.