Apple handed the keys to Google Cloud for its most sensitive AI infrastructure. At WWDC 2026, Apple confirmed that Private Cloud Compute (PCC) —the silicon-level secure enclave for offloading Apple Intelligence queries—is now built on top of Google Cloud’s Confidential Computing platform, using Intel TDX and NVIDIA Blackwell GPUs. That’s not a partnership announcement; it’s a tectonic shift in how hyperscalers earn trust for AI workloads.
Why Apple Dropped Its Own Hardware for Google’s Titanium
Apple doesn’t outsource security lightly. PCC was designed from the ground up to keep user data encrypted end-to-end, even from Apple itself. But scaling that to cloud inference required hardware guarantees that only a handful of providers can deliver. Google’s Titan chip provides the root of trust for the entire rack, while Intel TDX creates hardware-based Trusted Execution Environments (TEEs) on each CPU. NVIDIA Confidential Computing extends that isolation to the GPU memory bus on Blackwell GPUs, so no hypervisor, host OS, or even Google engineer can read the data during inference.
The Technical Stack: TDX + Blackwell + Open-Source Transparency
The collaboration isn’t just about buying VMs. Apple and Google co-engineered an open-source host stack for PCC that exposes every boot-time measurement and attestation report to external auditors. That’s rare for any cloud provider, let alone one hosting Apple’s crown-jewel privacy product. By baking Intel TDX’s memory encryption and attestation into the same control plane that manages NVIDIA Blackwell accelerators, the stack enforces that no privileged code can touch the model or its inputs—even if a compromise happens at the orchestrator layer.
What This Means for Confidential AI Everywhere
Google Cloud is now the only hyperscaler that can claim a production deployment of Confidential Computing spanning CPU and GPU for a customer with Apple’s security paranoia. The open-source host stack isn’t just altruism—it sets a bar that competitors like AWS Nitro or Azure Confidential VMs will have to match if they want to run similar privacy-critical AI workloads. Expect every enterprise with compliance-driven AI pipelines to start asking for attestation logs and hardware TEE support by default, not as an add-on.
Source: Powering the next era of Confidential AI
Domain: cloud.google.com
Comments load interactively on the live page.