Apple’s Private Cloud Compute Reaches Google, Powered by NVIDIA

Apple is putting Private Cloud Compute on Google Cloud for the first time, and the hardware inside the new deployment is not Apple’s. The new implementation, announced on June 8 alongside Apple’s third-generation Apple Foundation Models, leans on NVIDIA Blackwell GPUs with Confidential Computing as the inference engine, with Intel CPUs running TDX and Google’s Titan chip completing the stack. Only one model in Apple’s new line, AFM 3 Cloud Pro, runs on the new path; the other four stay on Apple silicon.

Apple’s Private Cloud Hits Google Hardware

Private Cloud Compute, or PCC, was built to handle Apple Intelligence requests that are too demanding for on-device models while keeping user data out of the reach of operators and administrators. Until this week, that work ran on Apple silicon inside Apple’s own data centers.

Now, Apple is collaborating with Google and NVIDIA to run new Apple Intelligence workloads on Google Cloud, the first time PCC has lived on third-party infrastructure. The change has a specific shape. Apple’s five foundation models split between on-device and server: AFM 3 Core and AFM 3 Core Advanced are on-device, while AFM Cloud, ADM 3 Cloud (Image), and AFM 3 Cloud Pro are server-based. The first four stay on Apple silicon. AFM 3 Cloud Pro is the only one that lives on Google’s servers, running on NVIDIA GPUs.

Apple announced the deployment during WWDC 2026 and published the technical details on its Apple Security Research blog the same day. The company is framing the change as one of implementation, not of requirements.

What Each Component Does

Apple’s security research post on the expansion lists the new stack in one line: NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google’s Titan chip. Each piece takes a different job in the chain of trust that wraps every inference request.

Apple built PCC on its own silicon in 2024. Industry players have since been working to combine confidential inference primitives from different vendors, but the building blocks have not lived in one deployment. The new Google Cloud arrangement is the first time Apple says those primitives have been integrated into a comprehensive, end-to-end confidential inference pipeline capable of operating at global scale.

NVIDIA’s own post on the deployment lists the three capabilities it contributes: hardware-rooted trust that the system is running on a genuine, untampered NVIDIA GPU, encrypted communication paths between components, and remote attestation that lets software verify the platform’s security state before any sensitive data is released.

The Privacy Contract Apple Says It Kept

Apple’s pitch is that the underlying requirements of PCC have not moved. The same five properties still apply: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency. What changed is the implementation, and the security engineering work is concentrated on the supply chain.

To keep that chain honest, Apple says it maintains a cryptographically verifiable, append-only ledger of every piece of Google Cloud hardware in the PCC fleet. For components that could be abused to exfiltrate user data if compromised, Apple’s software attestation is rooted in at least two separate roots of trust from independent vendors. Every component, from firmware through the host and guest OS stacks to application code, sits inside Apple’s trusted computing base, subject to its verifiable transparency and no-privileged-access guarantees.

On the question of who actually controls the software, Apple is explicit: Apple retains complete control over PCC software, and Apple devices will only trust PCC software that is cryptographically approved by Apple. The same architectural patterns that ran on Apple silicon still run on Google Cloud, including per-request network parsing in a dedicated process inside its own namespace, shared inference software recycled on a short time-to-live clock, and attested keys held in a separate, dedicated confidential VM isolated from external inputs.

Researchers will be able to check the work. All binaries will be published for public inspection, and Apple plans to give security researchers access to live PCC nodes in research mode through the Apple Security Bounty Program. That is the same depth of access Apple’s in-house deployment has long offered.

Apple says the design assumes that confidential computing primitives are necessary but not sufficient. The inference stack itself has to be built with privacy and security in mind from the start, the same principle Apple applied when it built the original PCC in 2024 and is now extending to third-party data centers.

The One Model That Lives On Google

The workload Apple chose to move is the most demanding one it runs. AFM 3 Cloud Pro, Apple’s most capable server-based model, powers the most demanding use cases, like agentic tool use and complex reasoning, according to Apple’s own model line-up, as reported in the third-generation Apple Foundation Models breakdown. The other four models stay on Apple silicon, where M-series accelerators can handle them. AFM 3 Cloud Pro is the only one routed through NVIDIA’s confidential GPU stack, and Apple says it was optimised for that hardware.

For end users, NVIDIA Confidential Computing means that no one, not even the system’s builders, can look at their data, chats or conversations.

That line comes from NVIDIA’s company blog on the deployment, where the company cast the deal as a marker of where AI infrastructure is heading. The same post argues that as AI products combine on-device and cloud processing, more workloads need server-side inference with strong privacy guarantees, and confidential computing on GPUs is the technology that makes that combination commercially usable. For NVIDIA, the Apple deployment is a high-profile consumer AI reference for a confidential GPU stack the company has been building since 2024.

Where The Cloud Spending Boom Fits In

The deal lands inside a cloud-infrastructure spending surge. Global cloud spending on infrastructure services rose 29% year over year in the final quarter of 2025 as hyperscalers funnelled money into AI compute capacity, according to analyst firm Omdia, cited in analyst notes on Apple’s enterprise AI reach. Omdia expects spend to increase again in 2026 as enterprise AI adoption shifts toward agentic workloads, the same class of tasks Apple routes through AFM 3 Cloud Pro.

IDC group VP Tom Mainelli told CIO Dive the move opens an enterprise door. Some of those users will be enterprise employees, he said. As developers build Apple Intelligence capabilities into their enterprise apps, the impact on the commercial side will grow. Gartner distinguished VP analyst Ed Anderson read the same shift: the Google Cloud and NVIDIA collaboration extends compute power while letting Apple keep its privacy commitments, a position he said could make Apple hardware more attractive in enterprise environments.

By the numbers

• 5 third-generation Apple Foundation Models (2 on-device, 3 server-side)
• 1 model on the new Google Cloud path (AFM 3 Cloud Pro)
• 29% year over year growth in global cloud infrastructure spending in Q4 2025 (Omdia)
• 20 billion parameters in AFM 3 Core Advanced, with 1 to 4 billion active per request
• 2 separate roots of trust from independent vendors in the attestation chain

The Summer Ramp And What Is Still Unfinished

The deployment is not complete. Apple says PCC on Google Cloud will be gradually ramping towards the complete set of protections throughout the summer preview period, the same beta window in which Apple is rolling out its third-generation Apple Intelligence features. The full protection set will arrive in stages rather than all at once.

Two public touchpoints are scheduled. Apple says it will share more technical detail at the Confidential Computing Summit later this month. An updated PCC Security Guide and refreshed research program details are due later this year. Until then, researchers and users are working from the public binary publication and the Apple Security Bounty Program access path.

Apple is not yet offering a hard date for the full protection set beyond the summer window. The PCC Security Guide update, when it lands, will be the public reference for what researchers should expect to see on a live Google Cloud node.

What is in production today is the early ramp: partial protections, full transparency publication, and the research-mode access path. The rest arrives as the beta progresses.

The Wider Bet On Confidential Computing

For NVIDIA, the Apple deployment is a high-profile consumer AI reference for a confidential GPU stack the company has been building since 2024. For Apple, the same deal reframes what its privacy brand means in production: the data still cannot be read by anyone, but the hardware doing the reading is no longer Apple’s.

That distinction is exactly the one Apple’s security team is betting its user-facing privacy claim on, and it is the one researchers will be able to inspect on a live node later this year. The Confidential Computing Summit later this month is the first technical checkpoint where the new implementation gets the kind of public review the original PCC stack earned.

Frequently Asked Questions

What is Apple Private Cloud Compute?

Private Cloud Compute, or PCC, is Apple’s cloud system for running Apple Intelligence features that are too large for on-device models. Apple introduced it in 2024 and built it to keep user data inaccessible to operators, administrators, and outside attackers, even on Apple’s own servers. Apple’s stated requirements are stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency.

What changed with the Google Cloud expansion?

For the first time, PCC now runs on third-party infrastructure. The new implementation combines NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google’s Titan chip. Apple’s core PCC requirements are unchanged; what changed is the hardware that runs them.

Which Apple Intelligence features run on the new infrastructure?

Only one of Apple’s five third-generation foundation models, AFM 3 Cloud Pro, runs on the Google Cloud path. The other four (AFM 3 Core, AFM 3 Core Advanced, AFM Cloud, and ADM 3 Cloud) stay on Apple silicon. AFM 3 Cloud Pro is built for the most demanding server tasks, including agentic tool use and complex reasoning.

What does Apple still control on third-party hardware?

Apple retains complete control over the PCC software stack. Apple devices will only trust PCC software that has been cryptographically approved by Apple, regardless of where the infrastructure is hosted. Apple also publishes the PCC binaries for public inspection, runs the Apple Security Bounty Program, and provides research tooling.

When will the full set of protections be live?

Apple says PCC on Google Cloud is gradually ramping towards the complete set of protections throughout the summer preview period. More technical detail is due at the Confidential Computing Summit later this month, and an updated PCC Security Guide is expected later this year.