Google is adding persistent, cross-device memory to its Private AI Compute platform, using encrypted cloud storage while keeping the keys on a person’s devices. The aim is to give AI assistants continuity without asking users to surrender the privacy advantages of local processing.
Google DeepMind Watch analysis
What happened
Google’s Private AI Compute team says the updated system will store personal context in dedicated encrypted databases inside isolated cloud environments. When an AI model needs that information, an end-to-end encrypted connection carries the request to a secure enclave, where the data is temporarily decrypted, used and then encrypted again.
The crucial design choice is that the cryptographic keys are derived from and held on the user’s devices, rather than by Google. Google says this should leave the stored information inaccessible to anyone else, including Google itself. The company says the work was developed by Google DeepMind alongside its Platforms & Devices, Core and Cloud teams.
Google is also publishing an updated technical whitepaper, a tamper-proof public record of the server software and an update on its technical methods. The announcement says it includes results from an independent cybersecurity audit, plus security proofs and verification protocols. Those materials will be important for testing the architecture’s claims beyond the rather persuasive theatre of a diagram.
Why it matters
AI assistants become much more useful when they remember a person’s preferences, unfinished tasks and earlier conversations. They also become much more intimate. Google’s proposal addresses the awkward gap between small, private on-device models and more capable cloud systems that need access to personal context.
The practical promise is continuity across devices without keeping the memory permanently exposed in ordinary cloud infrastructure. Someone could begin a task on a phone, continue it on a laptop and retrieve relevant context later through another device. The trade-off is complexity: privacy now depends on secure hardware, key management, authenticated software and correct implementation working together.
Our read
This is a substantial computing and privacy development because it tackles a real limitation of personal AI: cloud models have the muscle, while local processing has the trust advantage. Google is trying to combine the two rather than pretend the choice has disappeared.
The architecture sounds stronger than the usual “your data is safe” paragraph, because it identifies where data is stored, when it is decrypted and who holds the keys. But the announcement is still a design and verification claim, not proof that every failure mode has been eliminated. The technical brief, audit findings and public software record deserve close scrutiny from security researchers.
What to watch
- Whether independent researchers can reproduce or challenge Google’s security claims.
- How device loss, account recovery and multi-device access affect key management.
- Which Gemini products will receive persistent memory, and when.
- Whether the system remains usable when people move between old and new devices. The central bet is clear: personal AI may need to remember more, but it should not need to know everything. That is a much better starting point than handing the assistant the spare key and hoping it has good manners.
Discussion spark: Should persistent AI memory be kept in cloud enclaves with keys held by users’ devices, or is genuinely private memory worth the limits of on-device processing?
Sources and evidence
- Advancing Private AI Compute with secure, server-side memory (23 September 2026, 16:00 UTC)
not affiliated with, endorsed by, or operated by Google or Google DeepMind