Apple expands Private Cloud Compute to Google Cloud

Apple is expanding Private Cloud Compute beyond its own data centres. Selected demanding Apple Intelligence workloads will run on Google Cloud confidential-computing infrastructure using NVIDIA Blackwell, Intel TDX and independent Google hardware trust mechanisms.

This does not mean data “never reaches Google”. Selected workloads run on Google Cloud infrastructure. The architectural promise is different: the cloud operator should be unable to read data during computation or obtain privileged runtime access.

What Apple announced

In Expanding Private Cloud Compute, Apple describes retaining control of PCC software while computation runs on attested partner infrastructure. The system is intended to preserve key PCC properties:

processing without persistent user-data storage;
no privileged administrator access to the runtime;
inability to route one chosen user to a specially modified node;
remote attestation of code and hardware before data is sent;
public verifiability of software images and deployment mechanisms.

Google Cloud describes Titan, Titanium and Intel TDX as independent trust elements. NVIDIA discusses memory and execution protection on Blackwell Confidential Computing.

Protecting data while in use

Encryption at rest protects storage, and TLS protects transport. During ordinary computation a server normally sees data in memory. Confidential computing places that operation inside a hardware-isolated Trusted Execution Environment.

Before sending data, the client verifies attestation: evidence that the expected software version is running on approved hardware and configuration. If the measurement differs, the job should not receive user data.

This is not magical invisibility. Security depends on processor, firmware, boot chain, PCC software, attestation service, client and the process for publishing accepted measurements. A flaw in any layer can weaken the model.

Why independent roots of trust matter

If one party controls hardware, firmware, attestation registry and software, it can theoretically change every element together. Apple describes separation across Apple, Google, NVIDIA and Intel. An append-only hardware ledger is intended to make silent infrastructure substitution harder, while clients accept only publicly registered images.

The design increases the cost of a targeted operator or insider attack, but architecture is not proof of perfect implementation. Apple plans public binaries and research nodes, and some safeguards are arriving progressively during preview. Do not describe the announcement as a completed independent audit of the entire platform.

Questions for private-AI procurement

What protects data in memory during inference?
Can cloud administrators debug, snapshot or inject code into the runtime?
Does the client verify the exact software and policy through attestation?
Who controls each root of trust?
Are images reproducible or publicly comparable through transparency logs?
Can the operator target one user with a modified node?
Which controls are production-ready versus preview or roadmap?
What metadata and operational telemetry remain, even when inference is stateless?

Include these questions in third-party risk management and cloud architecture review.

What the direction changes

Organisations have often chosen between public-cloud scale and on-premises control. Confidential inference offers a third model: computation at an external provider in an environment the provider should not be able to inspect freely.

This is relevant for prompts containing documents, personal data and business context. It does not solve consent, data minimisation, model quality or disclosure through model output.

The accurate assessment holds two facts together: selected data is processed in Google Cloud, and the architecture is designed to technically limit Google and administrator access. Public artefacts, independent research and operation of all promised layers beyond preview will determine the strength of that claim.

Sources: Apple Security Research, Google Cloud Confidential AI, NVIDIA confidential computing.