Google will add persistent, server-side memory to Private AI Compute, the hardware-isolated cloud platform it uses to run Gemini models over sensitive personal data, and says the cryptographic keys that unlock that memory will live only on a user's own devices. The technical update published September 23 describes an architecture rather than a launch: its claims are written in future tense, and no availability date or product list is attached.
Key takeaways
- Private AI Compute has been strictly stateless until now, wiping all context the moment a task ends.
- The new layer stores per-user data in encrypted cloud databases shielded by device-derived keys, which Google says puts the contents beyond its own reach.
- Google is publishing a tamper-proof public record of its server software so a device can verify the code is unaltered before sending any personal data.
What actually changes
The platform already exists. Google DeepMind introduced Private AI Compute in November 2025 to push work too heavy for a phone into hardware-isolated cloud enclaves without exposing the input to Google, running Gemini models on custom Tensor Processing Units secured by what it calls Titanium Intelligence Enclaves. At launch the platform backed Magic Cue on Pixel 10 handsets and wider-language summarization in Pixel Recorder. Statelessness was its ceiling: context vanished when a task finished, so an AI assistant could carry nothing forward, and the standard workaround β having the model jot down a list of facts and preferences β does not reconstruct an actual history.
The update adds what Google calls a secure digital vault. Data an assistant needs gets sealed into dedicated encrypted storage organized as per-user databases, shielded by device-derived encryption keys. When a model needs that data, an authenticated end-to-end encrypted channel opens between the device and a secure enclave; the enclave decrypts the payload in isolated memory, handles the request, writes any new context, and re-encrypts it immediately.
Why the keys matter more than the enclave
Enclave processing is not new, and neither is a provider claiming it cannot see inside one. What distinguishes this design is where the keys sit. Because they are held exclusively on personal devices, Google positions the stored memory as inaccessible to anyone else, itself included β which is the only basis on which parking assistant memory in the cloud becomes defensible.
Verification is the other half of the pitch. Alongside an updated technical brief, Google is publishing a tamper-proof public record of the server software running the platform, so a device can confirm the code is authentic before transmitting anything. Independent auditors reviewed both the original release and this memory update, and summaries of the 2025 and 2026 audit reports are public. Help Net Security noted that Google frames its illustrations β pulling up assembly instructions on a laptop after viewing them through smart glasses, resuming a conversation between mobile and web β as architectural potential, not features anyone can use today.
What the update does not answer
The gaps are practical ones. Google has not said which products will use the memory layer, on what timeline, or what becomes of a user's vault if every device holding a key is lost. The post does not name the auditing firm in its text either. For an architecture whose entire privacy argument rests on device-held keys, key recovery is the obvious hard problem, and this update leaves it untouched. The technical brief does list next steps β client-side attestation so devices can independently validate server evidence, an append-only transparency log co-signed by third parties, wider reproducible build coverage, and recurring outside audits β which amounts to conceding that today's guarantees still lean on trusting Google's account of its own infrastructure.
The direction is still worth noting, because it inverts the industry's usual privacy answer. Apple's explanation of Siri's ambient listening rested on keeping the work local; Google is arguing that edge computing alone cannot host frontier models, so the cloud has to be engineered to behave like a device instead. Whether that argument survives contact with outside scrutiny depends on whether the published software record and audit summaries give researchers enough to actually check.
FAQ
Is Private AI Compute's server-side memory available now?
No. Google described the architecture in a technical update dated September 23, 2026, using future tense throughout, and attached no availability date or product list. The platform's existing stateless processing is what ships today.
Can Google read data stored in the new memory layer?
Google says it cannot. Per-user databases are encrypted with keys derived from and held on the user's own devices, and data is decrypted only inside a hardware-isolated enclave for the length of a request. The claim rests on that enclave design plus the published software record, which Google invites the privacy community to verify.
What is Private AI Compute used for?
It runs Gemini models over sensitive personal data inside hardware-isolated cloud enclaves, giving AI features more compute than a phone can supply while being designed so that nobody other than the user β Google included β can reach the data being processed.
