Apple Runs Private Cloud Compute on Google Cloud

Apple announced at WWDC 2026 that Private Cloud Compute—its privacy-preserving cloud inference system—now runs on Google Cloud infrastructure. Previously, PCC requests executed only on Apple silicon in Apple-owned data centers. The system integrates three hardware roots of trust: NVIDIA Confidential Computing on Blackwell GPUs, Intel TDX on host CPUs, and Google's Titan chip anchoring firmware-level trust.

Google Cloud processes workloads on-device models cannot handle: agentic tool use, complex reasoning, and inference on Apple Foundation Models (AFM Cloud Pro). Apple co-developed these models with Google using Gemini technologies and trained on Google TPUs since 2024. Running PCC on Google's infrastructure eliminates a cross-provider inference hop and its latency cost.

Apple's five core PCC requirements remain unchanged: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency. The implementation layer changed. Apple now maintains a cryptographically verifiable, append-only ledger tracking every physical hardware component in the Google Cloud PCC fleet independently. Software attestation for components capable of exfiltrating user data must be rooted in at least two separate roots of trust from independent vendors. Compromising any single vendor—Intel, NVIDIA, or Google—cannot break the verification chain.

Each request's initial network data parsing runs in a dedicated process within its own namespace. Shared inference software runs with a short time-to-live and recycles between requests. Attested keys live in a separate, dedicated confidential VM isolated from external inputs and not co-located with the inference execution environment. All PCC binaries on Google Cloud will be published for public inspection. Apple's Security Bounty program—which pays up to $1 million for arbitrary code execution vulnerabilities in PCC—now extends to Google Cloud-hosted nodes.

This sits at the ZOA tier: zero operator access, enforced cryptographically. ZDR (zero data retention) means no logs, but an operator with privileged access could observe in-flight data. ZOA means the inference execution environment sits inside a TEE stack that Google's operations team cannot inspect during active processing. No other hyperscaler customer has published an architecture with this level of independent hardware tracking on infrastructure they don't own.

Apple's PCC architecture assumes privacy guarantees hold at the hardware and software layer. What happens when Google's infrastructure faces a government data request remains unanswered in the published documentation. Apple historically litigated such requests on its own infrastructure.

Rollout begins summer 2026 as a preview. Apple's silicon-based PCC infrastructure continues in parallel. Google separately released open-source Prompt Encryption SDKs and announced Confidential G4 VMs with NVIDIA RTX PRO 6000 Blackwell GPUs in preview, lowering the bar for confidential AI inference beyond H100-class hardware. Financial terms and regional deployment details remain undisclosed.

The dual-root-of-trust attestation requirement and independent hardware ledger pattern are both replicable outside this Apple-Google arrangement. Any team running privacy-critical LLM inference on rented infrastructure can implement both without waiting for hyperscaler bundling.