Apple Expands Private Cloud Compute with NVIDIA GPUs on Google Cloud

Apple has started extending its Private Cloud Compute infrastructure beyond its own data centers. The company will use NVIDIA Blackwell with Confidential Computing on Google Cloud to perform confidential inference of AI models associated with Apple Intelligence, a move that unites three of the industry’s leading players in one of AI’s most sensitive areas: processing personal data in the cloud without sacrificing strong privacy guarantees.

NVIDIA has confirmed that its Confidential Computing GPUs are now used for confidential inference within Private Cloud Compute, the architecture Apple introduced in 2024 to extend some of its device privacy guarantees to the cloud. The key development is that PCC is no longer limited to Apple’s own infrastructure but now also runs on Google Cloud systems, with NVIDIA serving as the GPU acceleration provider.

Apple’s AI Needs More Cloud, But Not Just Any Cloud

Apple Intelligence was born with a challenging promise: to offer more useful AI features without turning users’ personal data into exposed raw material in a traditional cloud. For lightweight or highly private tasks, Apple relies on device processing. But some advanced features—especially those requiring larger models, complex reasoning, or the use of agentic tools—necessitate server capacity.

That is the space of Private Cloud Compute. Apple designed PCC so that requests sent from iPhone, iPad, or Mac are processed temporarily, without retaining personal data, with no privileged access for administrators, and with mechanisms that can be verified by security researchers. Until now, the system depended on Apple’s own servers with Apple Silicon. Extending to Google Cloud adds another layer of technical and trust complexity.

Apple assures that it maintains the same PCC requirements: stateless computing, enforceable technical guarantees, no privileged access during runtime, non-determinability of specific users, and verifiable transparency. The difference lies in the implementation. On Google Cloud, PCC leverages NVIDIA Confidential Computing with NVIDIA GPUs, Intel CPUs with TDX, and Google’s Titan chip.

What NVIDIA Confidential Computing Contributes

Confidential Computing aims to protect data not only when stored or in transit, but also during processing. This is especially crucial in AI because a request sent to a model often needs to be decrypted during inference. When inference occurs in the cloud, the challenge is to prevent administrators, privileged software, hypervisors, or external components from accessing sensitive information.

NVIDIA claims its technology creates a hardware-based security layer for accelerated AI workloads. Workloads are isolated in trusted execution environments, communications between components are encrypted, and infrastructure can be cryptographically verified before sensitive data is sent to the server.

Remote attestation is a key feature. It allows software to verify the security state of the platform before releasing information. Practically, the device or client system needs to confirm that the workload is running on an authorized platform, with genuine hardware and unmodified environment.

For NVIDIA, this partnership is an important validation of confidential computing in AI. For years, GPU security focused mainly on enterprise data centers, virtualization, and multi-tenant isolation. The AI explosion has raised the bar: it’s not enough to accelerate models; you also need to prove that processed data remains protected.

Apple, Google, and NVIDIA: Cooperation Without Borders

The announcement also underscores an important aspect of Apple’s strategy. The company wants to control the experience and privacy guarantees of Apple Intelligence but needs to collaborate with external providers to scale advanced features. Apple and Google have co-developed next-generation models leveraging Gemini-related technologies, while NVIDIA contributes acceleration and confidential computing capabilities.

This collaboration doesn’t mean Apple hands over its AI features to Google or NVIDIA. Apple maintains full control over PCC software, and devices will only trust software cryptographically approved by Apple. Additionally, PCC binaries continue to be published for public inspection, and research tools remain available, as is the case with the original Private Cloud Compute approach.

This nuance is critical. Apple aims to build a sort of extended cloud where the physical infrastructure provider isn’t the primary trust anchor. Trust shifts toward a combination of verifiable hardware, approved software, public transparency, no privileged access, and stateless design.

The promise is ambitious—and challenging. In a distributed architecture involving Apple, Google, NVIDIA, and Intel, the number of technical components increases. Apple acknowledges this complexity, indicating that PCC on Google Cloud will progressively roll out its full set of protections during the summer preview period.

Why This Matters for Private AI

Generative AI is now entering emails, documents, calendars, conversations, images, calls, personal assistants, and automation workflows. The more useful the assistant, the more context it needs. And the more context it receives, the more delicate the infrastructure becomes.

Purely local solutions better protect privacy but limit model size and capabilities. Pure cloud solutions enable large models but require greater trust in providers. Private Cloud Compute strikes a middle ground: send only what’s necessary to the cloud, process it on verified infrastructure, and don’t retain personal data after the response.

The addition of NVIDIA GPUs to PCC shows that Apple needs more performance for upcoming features. Inference workloads for foundational models, reasoning, and agents can be very demanding. Without GPU acceleration, scaling these capabilities globally would be much harder.

This also indicates where the industry is headed. Future assistants will not live solely on devices or solely in the cloud. They will operate in a hybrid architecture, with some tasks running locally and others offloaded to specialized servers. How each platform manages this handoff will be a key differentiator.

A Direct Pressure on the Rest of the Market

Apple’s move could set a higher bar for other consumer AI providers. Many services promise privacy, but few offer verifiable mechanisms at this level of detail. Apple has made PCC’s security part of its commercial and technical message, and now aims to maintain that even when using third-party infrastructure.

That said, no system is immune to risks. No cloud architecture is perfect. Academic researchers have emphasized that evaluating such systems requires access, reproducibility, transparency, and real auditability. Apple is attempting to address this with binary releases, transparency logs, and research programs, but trust will need to be earned over time and through external scrutiny.

For Google Cloud, this agreement reinforces its role as a provider of infrastructure for sensitive AI workloads. For NVIDIA, it confirms that the next phase of AI will be judged not just on raw performance but also on security guarantees during inference and training. For Apple, it enables expanding Apple Intelligence without compromising its privacy narrative.

The result is an architecture that closely reflects the current stage of AI development. Models require increasingly powerful data centers, yet users and regulators demand more control over data. The solution will involve a combination of chips, software, attestation, encryption, transparency, and operational design.

Privacy Becomes Infrastructure

For years, digital service privacy was primarily communicated through policies, permissions, and promises not to exploit data. AI necessitates a deeper approach. If an assistant needs to process personal information to be useful, privacy must be embedded in the architecture, not just in the contract.

Apple aims to turn this idea into a competitive advantage. Extending PCC to Google Cloud with NVIDIA Confidential Computing sends a clear signal: AI privacy is no longer confined to devices. It now encompasses servers, GPUs, root of trust, verifiable logs, and technical restrictions on administrative access.

The most interesting part isn’t just that Apple uses NVIDIA GPUs or Google infrastructure. That was almost inevitable to scale certain capabilities. What matters is how Apple tries to do so without diluting its privacy model. If PCC can maintain its guarantees outside Apple’s data centers, it could set a standard for other AI services that need to combine performance and data protection.

Personal AI will be more powerful if it can handle more context. The key question is: who can process that context without creating a new vulnerability? Apple, Google, and NVIDIA have just laid out a technically ambitious answer. The next step is proving that it works at scale and withstands security scrutiny.

FAQs

What has NVIDIA announced about Apple Private Cloud Compute?

NVIDIA announced that its Confidential Computing GPUs are used for confidential inference within Apple Private Cloud Compute, now also on Google Cloud.

What is Private Cloud Compute?

Private Cloud Compute is Apple’s architecture for processing larger AI tasks in the cloud while maintaining privacy guarantees, stateless computing, and verifiable transparency.

Why does Apple use Google Cloud and NVIDIA?

Apple needs more inference capacity for new Apple Intelligence features. Google Cloud provides scalable infrastructure, while NVIDIA offers Blackwell GPUs with Confidential Computing to accelerate sensitive workloads.

Does this mean Google or NVIDIA can see user data?

Apple and NVIDIA contend that the architecture is designed to prevent providers, administrators, or even system builders from accessing processed data. Guarantees rely on isolation, encryption, remote attestation, and verifiable controls.