Privacy and data retention

Use of Aperture is governed by the Aperture Terms.

Aperture captures the full request and response body and headers, which include tool use data alongside usage metrics such as token counts, model, and estimated cost. This topic covers controls for where captured data is stored, how long it persists, where request content leaves Aperture, and how Aperture gateway data is handled when you decommission an Aperture gateway. Retention settings apply to request and response bodies, not to usage metrics, so reporting and analytics stay available after Aperture purges request bodies.

Control retention

Configure how long Aperture keeps captured request and response bodies before it purges them, or enable zero data retention so bodies are never written to disk. The retention fields (duration, purge, and require_export) are documented in the database configuration reference.

Configure zero-retention mode

Configure Aperture to not store captured prompt and response content on disk, and learn which Chat and hook data the setting does not cover.

Export and archive usage data

Export captured usage data to S3-compatible storage for long-term retention and archiving. You can require export before Aperture purges local captures, so no records are lost when retention expires.

Export usage data to S3

Configure Aperture to export LLM usage data to an Amazon S3 bucket for analysis, archiving, and long-term retention.

Observe and export AI usage

Review your own Aperture usage in Chat or use the admin dashboard to inspect and export organization-wide activity.

Control third-party data egress

Control how request content leaves Aperture:

• Guardrails inspect, modify, or block requests before they reach the provider.
• Connectors centralize authentication and proxy outbound calls to external MCP servers and HTTP APIs.
• Integrations forward request and usage data to external enforcement and observability tools.

Decommission an Aperture gateway and delete data

You can decommission a managed Aperture gateway at any time directly from the admin console without contacting Tailscale Support. Doing so does not delete it immediately. Instead, the data is retained for a 7-day grace period before Aperture deletes it. If you deleted your gateway by accident and the grace period hasn't passed, contact Tailscale Support to restore it. After the grace period, you cannot recover the deleted gateway.

Delete an Aperture gateway

To delete a managed gateway:

1. Open the Aperture admin console.
2. In the bottom-left corner of the sidebar, select Delete your gateway.
3. Confirm the deletion in the confirmation dialog.

Data destruction and grace period

When you start gateway deletion, the gateway device node goes offline immediately, and Aperture places the gateway into a 7-day grace period buffer. This window prevents accidental deletion and enables Tailscale to restore the gateway from backup if needed.

Following the expiration of the grace period:

• Configuration and credentials: Your gateway configuration, stored provider API keys and credentials, access grants, and quota definitions are permanently deleted.
• Captured content: All request and response bodies, headers, tool-call details, and database backups are destroyed.
• Node removal: Once the gateway is fully erased, its offline device node is automatically removed from the Machines page of the Tailscale admin console (unless the node was registered as ephemeral).