AI
Apple Launches Private Cloud Compute on Google Cloud with Triple-Layer Hardware Security
Apple's confidential AI inference engine now runs on Google Cloud infrastructure with unprecedented hardware-level verification and operator-access restrictions.
InfoQ
Apple has expanded its Private Cloud Compute (PCC) platform to Google Cloud, marking the first time the company is running its privacy-critical AI workloads outside its own data centers. Unveiled at WWDC 2026, the partnership combines three independent layers of cryptographic hardware security—NVIDIA Confidential Computing on Blackwell GPUs, Intel TDX on processors, and Google's Titan chip as the foundation—to create what Apple calls "the first time these primitives have been integrated into a comprehensive, end-to-end confidential inference pipeline capable of operating at a global scale."
Why Google Cloud, Why Now#
The choice reflects Apple's evolving AI strategy. PCC handles computations too large for on-device processing—agentic tool use, complex reasoning, and Apple's next-generation foundation models, which were developed jointly with Google using technologies from the Gemini family. A multi-year agreement signed in January 2026 already committed Apple to using Google Cloud infrastructure for model training; running inference on the same infrastructure eliminates cross-provider latency and complexity. The tradeoff introduces a dependency that Apple addresses through engineering rather than avoiding it.
Industry observers flagged the underlying business reality. As defense architect Jonathan Sandhu noted on LinkedIn: "The reason this happened isn't privacy architecture. It's that Google built the foundation models powering the next generation of Apple Intelligence." Apple needed Google's inference capability and engineered a cryptographic solution to preserve its privacy narrative around the arrangement.
A New Trust Model for Cloud Infrastructure#
Rather than relying on Google's attestation alone, Apple implements unprecedented levels of independent verification. The company maintains an append-only, cryptographically verifiable ledger tracking every physical component in the Google Cloud PCC fleet—treating each piece of hardware as independently auditable rather than trusting Google's internal records. Crucially, software attestation for any data-exfiltration-capable component roots itself in at least two separate vendor roots of trust (Intel, NVIDIA, and Google), ensuring that compromising a single vendor cannot break the verification chain.
All PCC binaries running on Google Cloud are publicly available for inspection. Apple's Security Bounty program extends to the Google-hosted infrastructure. Core PCC guarantees remain unchanged: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency.
