Google introduced Private AI Compute in November 2025 as a way to run Gemini cloud models on sensitive information inside hardware-isolated environments. The infrastructure already supports some Pixel experiences, including Magic Cue and expanded Recorder summarization. Its processing model, however, was deliberately stateless.

A request could enter the protected environment, be processed and then leave no persistent context behind once the job ended. On September 23, Google DeepMind described the architecture intended to remove that restriction and let Private AI Compute retain information over time.

Cloud storage, device-held keys

Google's proposed design is essentially an encrypted vault. Information required by the assistant would remain in dedicated server-side storage, while the cryptographic keys needed to unlock it would be held on the user's personal devices.

When a model needs that information, Google says the device establishes an authenticated, end-to-end encrypted channel to an isolated cloud environment. The data is temporarily decrypted inside protected memory, used to process the request, updated with new context when necessary, and then immediately encrypted again before being stored.

The architecture also uses per-user databases protected with device-derived encryption keys. Google says this arrangement is designed to prevent anyone else, including Google itself, from accessing the stored information. That remains a security claim about the architecture rather than independent proof that every future product built on it will automatically preserve identical guarantees in every deployment.

Why memory cannot simply stay on the phone

Keeping everything local has an obvious privacy advantage: information does not need to leave the device. The model becomes harder to sustain when an assistant needs continuity across multiple devices or requires more compute than a phone can provide.

Google gives examples such as viewing assembly instructions through smart glasses and later picking them up on a laptop, or continuing a complex conversation between mobile and web. Persistent server-side memory could preserve that context without requiring each device to store and process the entire history locally.

That is also the underlying reason Private AI Compute exists. Google argues that frontier AI models can demand more computation than individual devices can offer, while proactive assistants increasingly need access to personal context. Until now, the secure cloud environment could process that context but could not retain it between jobs.

The server itself has to prove what it is running

Google is pairing the memory architecture with an additional transparency mechanism. The company says it is publishing a tamper-resistant public record of the software running on Private AI Compute servers. A device should be able to verify that the remote software is authentic and unmodified before sending personal information to it.

That extends the remote-attestation model already used by Private AI Compute. The trust model is not meant to stop at “this server belongs to Google.” The client is supposed to cryptographically verify the environment receiving its information.

DeepMind also says it has updated the system's technical documentation and is providing results from an independent audit conducted by a cybersecurity company. The public announcement does not identify that firm. Those materials add another layer of scrutiny, although the real test will come when persistent memory is deployed inside consumer products.

This is not a new Gemini memory switch you can turn on today

The timing matters. Google says the architecture will enable persistent, cross-device memory and explains how that system is designed to work. It does not announce a general launch date, a list of supported devices or a new Gemini setting that is immediately available to everyone.

Private AI Compute itself has been operating since 2025. The persistent-memory layer described this week is an architectural expansion, not confirmation that all Gemini conversations are now being stored through this mechanism.

Google is trying to solve a fairly direct contradiction in personal AI: an assistant becomes more useful when it remembers you, while that same memory becomes more sensitive as it grows. The technical design is now public. The consumer rollout is still ahead.