Google DeepMind published the technical design for a persistent, cross-device memory layer inside Private AI Compute, the company’s hardware-isolated cloud processing system. The pitch: an assistant that remembers a conversation you started on your phone and finishes on your laptop, without Google holding a readable copy of what it remembers.
The mechanism, as DeepMind describes it, works like a vault with two separate keyholders. Your data sits encrypted in cloud storage. The cryptographic keys needed to unlock it live only on your own devices. When the assistant needs that context to answer a question, an encrypted channel opens between your device and what DeepMind calls a “secure enclave,” a hardware-isolated environment in the cloud that decrypts the data in isolated memory, uses it, saves any new context, and re-encrypts it immediately.
That design answers a real limitation. Private AI Compute launched as a stateless system: it processed a task in an isolated cloud enclave and then discarded everything, the same tradeoff most on-device privacy architectures make. A chatbot that forgets everything the moment you close the tab cannot support the kind of ongoing assistance Google wants to sell, so engineering persistent memory without breaking the privacy guarantee was the harder problem DeepMind says this solves.
This is Google’s own account of its own system, not an independent verification of it. The company says it is releasing a technical whitepaper, a public and tamper-checkable record of the server software so devices can confirm what code is actually running before they send data, and results from an audit by an outside cybersecurity firm. DeepMind did not name that firm in the post announcing the work, and the audit results themselves have not been published alongside it, only referenced as forthcoming.
The trust question this architecture cannot resolve on paper is enforcement. A secure enclave is only as private as its supply chain: the chip vendor, the enclave firmware, and Google’s own operational access to the infrastructure that hosts it. The tamper-proof software record is meant to let a device verify the code before it trusts the enclave, which is a stronger guarantee than “trust us,” but it still depends on Google publishing every version of that server software honestly and on researchers actually checking it against what ships. Persistent memory is also a bigger target than a stateless system ever was: a database an attacker only needs to reach once is a different risk profile than one that is wiped after each session, even if the keys sit elsewhere.
Google has not said when this capability ships in a consumer product or which Private AI Compute users get it first. The company also has not disclosed how long memory persists, whether users can inspect or delete what is stored, or what happens to a device’s keys, and therefore its memory, when that device is lost or replaced.
For any team building an AI assistant that promises cross-device continuity, this is the architecture to benchmark against before promising the same thing with a weaker privacy story. The independent audit Google says it commissioned, once it is actually published in full, is the document worth reading before taking the claim at face value.
Google DeepMind’s Private AI Compute Team published this architecture update on the DeepMind blog on September 23, 2026.
