Google puts a private memory vault in the cloud for cross-device AI

Google DeepMind published a technical update on its Private AI Compute platform: it is adding a persistent, server-side memory layer that keeps cross-device AI context in the cloud while, in Google's words, upholding the privacy standards usually reserved for on-device processing. The design claim that stands out: the data sits in dedicated, encrypted cloud storage, and the cryptographic keys needed to unlock it live exclusively on your personal devices, meaning the data is inaccessible to anyone else, including Google, according to the company.

How the vault works

The update describes the memory layer as functioning like a "secure digital vault" in the cloud. When an AI model needs to access your stored context, an authenticated, end-to-end encrypted channel connects your device to what Google calls a secure enclave: an isolated, hardware-enforced environment in the cloud. Inside it, your data is temporarily decrypted in isolated memory to handle the request, any new context is saved, and everything is immediately re-encrypted. The architecture combines those hardware-enforced enclaves, encrypted channels, and per-user databases shielded by device-derived encryption keys.

That last detail is what separates this from ordinary encrypted storage. With server-side keys managed by the provider, the provider can technically read the data; with keys derived from your device, the provider stores ciphertext it cannot open. Google presents the combination as keeping your information private "as if it never left your device."

Why move memory to the cloud at all

On-device processing has historically been the privacy gold standard, but Google's stated problem is compute: frontier models often need far more processing power than a single device can provide. The Private AI Compute platform, introduced earlier, already let users run complex tasks in hardware-isolated cloud enclaves, but until now it was strictly "stateless," wiping all context the moment a task ended. The workaround Google notes, such as having an assistant save a flat list of personal facts and preferences, does not support the kind of continuous experience the company wants to offer.

The target use cases are continuity across devices: resuming a complex conversation between your phone and the web, or pulling up the assembly instructions you previously viewed through smart glasses on your laptop. Making that work means the cloud has to retain context over time and across devices, which is the gap this update addresses.

The trust part

Google acknowledges that users have to trust the system's privacy, and the announcement leans on verification rather than assurance. Alongside an updated technical whitepaper, Google is publishing a tamper-proof public record of the server software, so devices running Private AI Compute can verify that the software is authentic and unaltered before any personal data is sent. The post also references updated technical methods, including the results of an independent audit by a leading cybersecurity firm, and invites the privacy community to review the Technical Brief, the system architecture, the security proofs, and the verification protocols.

That posture matters for a different reason than marketing: remote enclaves and client-held keys are a real architectural pattern, but a design's guarantees only hold if the server software behaves exactly as proven. A public, verifiable record of that software is what lets third parties check that claim instead of taking Google's word for it.

What it means for you

For now this is a platform architecture, not a product announcement: the post describes how the system works and points to the whitepaper and verification tooling, without detailing which products or devices will ship with persistent Private AI Compute memory. If you're evaluating where your data lives when you use cloud-based personal assistants, the two lines worth watching are whether the keys really stay on your device, and whether the server software is verifiable by someone other than the vendor. Google says both are the design here; the published record is where you can check that.