Google Private AI Compute: what it protects, and who checks it

The Morse teamPublished November 1, 20267 min read

Google Private AI Compute is Google's cloud system for running Gemini models on personal data from Pixel and Android features, inside hardware-isolated servers that Google says keep the data "accessible only to you and no one else, not even Google." As of November 1, 2026, it powers Magic Cue suggestions, Recorder summaries, the Pixel Journal app's AI features, and the opt-in Enhanced scam protection in Google Messages, and it runs on Google's own TPUs and data centers.

On November 1, 2026, we read Google's launch post, its technical brief (dated September 2026), Google DeepMind's September 23, 2026 post on server-side memory, Google's help pages for each feature, NCC Group's public audit report, and Apple's Private Cloud Compute documentation. Google deserves credit here. It published a 15-page brief, paid an outside firm for 100 person-days of review, and let that firm publish its findings. Google's phones don't yet check the servers themselves, and the brief says so.

What is Google Private AI Compute?

It's Google's answer to Apple's Private Cloud Compute, announced on November 11, 2025. Google describes it as "a secure, fortified space for processing your data" that brings its most capable Gemini models to data that would otherwise stay on the phone (Google). The brief says the system "processes the same type of sensitive information you might expect to be processed on-device," naming audio, end-to-end encrypted messages, and screen content as examples (Google brief).

There's no switch called Private AI Compute. Each Google feature decides whether to send your data there.

How does Private AI Compute work?

It chains several of Google's own machines, each of which has to prove what it's running before the next one will talk to it. From Google's September 2026 brief:

• Two kinds of protected hardware. CPU work runs in "an AMD-based hardware Trusted Execution Environment," and the Gemini models run on what Google calls a hardened TPU platform, its Titanium Intelligence Enclave, which Google says gives "privacy and security properties comparable to a typical TEE."
• Encrypted hops, each attested. Your phone opens a Noise-encrypted connection to a frontend server, which talks to the model servers over Google's ALTS channels. Servers get their credentials only after their attestation matches "internal reference values."
• Your identity stays off the request. Third-party relays hide your IP address, and a separate server swaps your device's credentials for an anonymous token, so "a user's identity never travels with their data on the inference path."
• Nothing kept by default. For ordinary requests, inputs and results are kept "only as long as needed to fulfill the user's query," and Google says no administrator can reach them, "even in 'break glass' emergency scenarios."

We explain the underlying technology in what a trusted execution environment is.

Can Google see your data in Private AI Compute?

Google says no. Its auditor says Google, as a company, still could. NCC Group's public report, dated November 11, 2025, concludes that Google "has robustly limited the risk of user data being exposed to unexpected processing or outsiders, unless Google, as a whole organization, decides to do so," and that "it is unavoidable that Google ultimately has this power" (NCC Group). The same report says users get "a high level of protection from malicious insiders."

The reason is in Google's own brief. Today, the servers check each other's attestation against Google's reference values, and your phone checks a key that Google hands only to servers that passed. The brief lists "client-side attestation verification," "moving from Google-asserted compliance toward client-side cryptographic verification," under "What's next." Until it ships, Google decides which servers count as trusted.

NCC Group also found a timing side channel in the IP-blinding relay that "may be able to unmask target Private AI Compute users when particular conditions are met," rated low for exploitability. Google's reply in the report says the system resists it because many users' traffic adds noise. The CPU side runs on AMD SEV-SNP, one of the TEEs that 2025 research broke with physical access to the server, and Google's brief answers that risk with the physical security of its data centers.

Which features use Private AI Compute?

As of November 1, 2026, Google's own pages name four:

Google announced the Messages feature on October 14, 2026 as "this new opt-in security setting," rolling out "in the coming weeks" (Google). Standard protection, the default, works with your messages on your phone.

None of the pages we read puts chats in the Gemini app inside Private AI Compute. Those follow the Gemini Apps Privacy Notice, which we cover in is Gemini private.

What is Private AI Compute's server-side memory?

It's a new layer, added in September 2026, that lets Google features remember things about you across sessions and devices while, Google says, staying "inaccessible to anyone else, even Google" (Google DeepMind). The brief says each user's records are encrypted with per-user keys that are released only to an enclave that proves it's running an endorsed build, and that this memory server is open source and written in Rust.

Persistent memory gives up one protection, and Google says so. Because a request has to find your store, the brief says the memory system "does not claim network-level non-targetability." Instead, it says targeting one user's memory "yields only opaque ciphertext," because the keys exist in plaintext only inside an attested enclave. Google DeepMind's post doesn't name a product that uses this memory yet.

Is Private AI Compute the same as Apple's Private Cloud Compute?

They share a design but differ on who checks. We read both companies' documentation on November 1, 2026:

Apple's guide adds that a device sends a request only to nodes "whose attested measurements match a release recorded in the transparency log." That's the step Google's brief puts under "What's next." For Apple's side in depth, including its move onto Google Cloud, read is Apple Intelligence private. For what a client-side check involves, read how to verify an AI enclave's attestation.

How Morse lets you choose an enclave and check it yourself

Private AI Compute protects what Google decides to send it, and Google is the one vouching for the servers. You can't open a chat and choose to run it there, and your phone relies on Google's own check of each server.

Morse puts both choices with you, per chat:

• E2EE, for anything you'd only send to a server your own device has checked. Your browser verifies the enclave's cryptographic proof itself, against versions pinned in the app, before anything leaves your device, then seals the message for that enclave only. Morse's servers relay ciphertext they can't read. Open-weight models like GLM, Kimi, and DeepSeek answer inside, and every reply carries a lock showing each check that passed. The guarantee depends on the enclave hardware and attestation working as designed, and the enclaves are run by third-party providers, not by Morse.
• Anonymous, to ask Gemini without Google knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. Google still sees the message, and may keep it for a limited time to check for abuse, under its own policy.
• Private, for open-weight models and Grok, on hosts that agreed to keep nothing. Morse has zero data retention agreements with its inference, search, and other providers.

In every mode, your chat history is stored in your browser, encrypted, not on our servers, and Morse doesn't train AI on your content, sell your data, or show ads. E2EE runs open-weight models only, with no web search or image generation, so start a separate chat when you need those. Apple, Google, and several private AI apps use enclaves too. On Morse, you pick E2EE for any chat you start, and your own browser runs the check.

Try a chat from the Morse home page without an account, or start free; E2EE chats come with Pro, at $19 a month.