Google Adds Server-Side Memory to Private AI Compute

Google DeepMind introduced private, server-side memory to Private AI Compute for personal AI. The announcement expands on the original platform launched on November 11, 2025, which combined Gemini cloud models with the security and privacy assurances of on-device processing. Before this persistent memory update, Private AI Compute was strictly stateless and wiped all context the moment a task ended. Google stated that older workarounds, such as having the assistant save lists of personal facts and preferences, were insufficient to support continuous personal AI experiences.

At its core is the memory Oak Server, a stateful per-user database running inside a hardware trusted execution environment. Records inside this database are encrypted under per-user keys that are never visible outside the system’s trusted computing base or to Google infrastructure. Under this model, information needed to assist a user is sealed within dedicated, encrypted storage, while the cryptographic keys required to unlock it are held exclusively on the user’s personal devices. When a model needs stored information to handle a request, an authenticated, end-to-end encrypted channel connects the device to a protected, isolated environment in the cloud. A secure enclave temporarily decrypts data in isolated memory, saves any new context, and immediately re-encrypts it. An orchestrator mediates between the AI model and the memory server so that plaintext never leaves the enclave.

Retrieved context is merged with the active prompt and evaluated entirely within the hardened TPU platform. Google describes the design as combining hardware-enforced secure enclaves, encrypted channels, and per-user databases shielded by device-derived encryption keys. Stated security goals for the persistent store include no administrative path to plaintext user data even in break-glass emergency scenarios, containment of a compromised instance through confidential virtual machines, and default-deny egress policies covering monitoring, logging, and core dumps. Google states that its encrypted storage arrangement makes user data inaccessible to anyone else, including Google itself, yielding only opaque ciphertext because decryption keys are available only inside an attested enclave. Google says external auditors validated the system design for both the initial release and the server-side memory update, and it has published summaries of the 2025 and 2026 audit reports.

For a request requiring historical context, the lifecycle begins with the client establishing an encrypted session via the Noise Protocol. This session reaches an orchestration enclave inside an AMD SEV-SNP confidential virtual machine, which then opens a mutually attested ALTS channel to the memory server. Reproducible builds tie the published source to the binaries deployed in production, with the resulting digests publicly endorsed in an append-only ledger and attested by the enclave before any key is released. Key release to the memory server is gated on attestation, meaning an enclave that cannot present valid attestation evidence matching an endorsed memory binary cannot obtain keys and cannot read a user’s memory. According to the company, devices running Private AI Compute will be able to verify that the software is authentic and unaltered against the public record before sending any personal data.

The memory application is written in Rust and runs in the Oak Containers runtime, and both the server and the runtime are open source. The work was co-developed by Google DeepMind with the Platforms and Devices, Core, and Cloud teams. Executive sponsorship for the project was provided by Four Flynn, Jay Yagnik, who serves as the vice president of AI innovation and research at Google, and David Kleidermacher.

At launch, Google said Private AI Compute would make Magic Cue more helpful on Pixel 10 phones and allow the Pixel Recorder app to summarize transcriptions across a wider range of languages. Alongside the announcement, Google released an updated technical brief, a public record of its server software, and summaries of independent audits.