Google DeepMind adds persistent, encrypted server-side memory to Private AI Compute

Google DeepMind published a technical update on September 23, 2026 describing a new server-side memory layer for Private AI Compute, its confidential-computing platform for personal AI assistants. The addition lets a Gemini-based assistant retain context across sessions and devices while keeping that data encrypted at every point except the brief moment it's actually being used.

What's new

The core design keeps a user's data encrypted in Google's cloud and keeps the keys to unlock it off Google's servers entirely. In Google's words: "The information needed to assist you is sealed within dedicated, encrypted storage, while the cryptographic keys required to unlock it are held exclusively on your personal devices." That means Google's own infrastructure stores ciphertext it cannot read without the user's device supplying the key.

When a request actually needs that memory, it's processed inside what Google calls a secure enclave: "That space, or 'secure enclave,' temporarily decrypts your data in isolated memory to handle the request, saves any new context, and immediately encrypts it." The decrypted window is scoped to a single request; new context gets written back and re-encrypted right away rather than sitting in the clear.

Google describes the full stack as three layers working together: "By combining hardware-enforced secure enclaves, encrypted channels, and per-user databases shielded by device-derived encryption keys, this architecture ensures your data stays fully private and under your control."

Context

Private AI Compute is Google's answer to a structural problem with cloud AI assistants: the models are too large to run entirely on a phone, but running them in the cloud has historically meant a user's data lives somewhere the provider can, in principle, read. Earlier versions of the platform handled individual requests under this kind of protection but didn't retain memory between them. This update is what turns Private AI Compute from a one-shot system into one that can remember a preference from last week or a project mentioned yesterday without keeping a permanent, plaintext copy of it on a server.

Why it matters

Persistent memory is becoming table stakes for AI assistants: a system that forgets everything between sessions feels noticeably worse to use than one that doesn't. The trouble is that memory and privacy usually pull in opposite directions, since remembering more about a user generally means storing more about them somewhere. Google's architecture is an attempt to get both by making the server incapable of reading what it stores, rather than merely promising not to look. The approach mirrors the logic Apple used for iCloud's end-to-end encrypted data and Signal used for its own infrastructure: keep the operator cryptographically locked out, not just policy-locked out. If it holds up under scrutiny, it gives Google a concrete answer to a question every AI assistant vendor with a memory feature is going to keep getting asked: where does my data actually sit, and who can read it.