Google is adding persistent server-side memory to Private AI Compute, its protected cloud architecture for personal AI workloads. The goal is to let assistants carry context across sessions and devices while keeping stored memories encrypted outside the system’s trusted execution environment.
Google says the keys needed to unlock that memory remain on a user’s personal devices. When an assistant needs historical context, the client establishes an authenticated end-to-end encrypted channel to an isolated cloud environment, where the relevant data is temporarily decrypted in protected memory for processing.
What changed
Private AI Compute was previously designed as a stateless service, meaning context disappeared when a task finished. The new memory layer introduces per-user persistent storage so selected context can survive across requests and devices.
Google’s design keeps plaintext away from ordinary cloud infrastructure. Stored memories remain encrypted, and decryption is restricted to hardware-protected enclave environments after the system verifies that approved software is actually running.
How the protection works
The architecture combines hardware-enforced isolation, encrypted communication paths and per-user databases protected with device-derived key material. Google also describes an attestation step in which the trusted environment must prove its software identity before it can work with user keys and memory.
Alongside the architecture update, Google is publishing technical documentation and a tamper-resistant public record of server software. The intent is for client devices to verify that they are connecting to an authentic, unmodified build before sending sensitive information into the cloud.
What users gain
The practical benefit is continuity without keeping a normal readable cloud history. An assistant could resume a task on a laptop that began on another device or pick up a long-running conversation without forcing the user to restate everything from scratch.
Persistent memory still expands the system’s attack surface and raises the bar for key management, isolation and operational controls. That is why Google is pairing the feature with enclave isolation, software attestation and external security review rather than treating encryption alone as sufficient.
Why it matters
Personal assistants become much more useful once they can remember preferences, unfinished tasks and prior context. The usual cloud approach, however, makes that memory available to backend systems in ways that are difficult to reconcile with strong privacy guarantees. Private AI Compute is attempting to solve that tension at the architecture level.
If the design holds up under real-world use and review, it could become an important model for cloud AI: large models gain persistent personalization without requiring the provider to have routine access to plaintext memory. The long-term test will be whether Google maintains verifiable software, transparent attestation and independent scrutiny as the system evolves.
