Advancing Private AI Compute with secure, server-side memory

Personal AI needs memory across phones, glasses, and laptops. On-device processing cannot host frontier models alone; plain cloud memory breaks the privacy story.

DeepMind and Google’s Private AI Compute team describe a persistent memory layer sealed in dedicated encrypted storage, with cryptographic keys held only on the user’s devices—even Google cannot unlock it.

They are also publishing a tamper-proof public record of server software and pointing to an independent cybersecurity audit. Trust here is the product.

We have been waiting for someone serious to attack the continuity-versus-privacy bind. Private AI Compute used to be stateless: wipe context when the task ends. Workarounds that save a list of facts were never going to feel like a real assistant.

The architecture they sketch is the right shape. An authenticated, end-to-end encrypted channel opens into a secure enclave; data decrypts temporarily in isolated memory, new context is saved, then everything is sealed again. Hardware enclaves plus device-derived keys is how you argue the cloud can feel like on-device.

I’m watching whether the verification story holds. A public software record devices can check before sending data is the kind of transparency personal AI needs if it is going to remember assembly instructions from your glasses on your laptop later.

Useful AI gets the benefit of the doubt when the engineering matches the pitch. The downside if this scales badly is familiar: a false sense of safety, audit theater, or key-management failures that turn the vault into a target. Google is inviting the privacy community to verify the brief. We should take them up on that—not clap and move on.

Posted September 23, 2026, by the Google Private AI Compute Team, co-developed with DeepMind, Platforms & Devices, Core, and Cloud. It updates a previously stateless Private AI Compute platform.