Apple Private Cloud Compute expands to Google Cloud with Nvidia confidential GPUs

For two years Private Cloud Compute was the architectural answer to a single question: how can Apple run server-side AI without anyone, including Apple, being able to read your data? The original 2024 design answered it with vertical control, running PCC exclusively on custom Apple silicon inside Apple-controlled facilities ^[7]. The WWDC 2026 announcement breaks that boundary. Apple is now running new Apple Intelligence workloads on Google Cloud, powered by NVIDIA Blackwell GPUs, the first time PCC has executed outside Apple's own data centers ^[1]. The optics are striking given that just a year earlier Apple executives publicly dismissed the idea of a 'bolted-on chatbot' ^[5]. The reframing Apple offers is that ownership of the metal was never the point; cryptographic control over the software stack is. Apple says its five core PCC requirements, including stateless computation, no privileged runtime access, and verifiable transparency, remain exactly the same on Google's infrastructure ^[1].

The mechanism that lets Apple make that claim is confidential computing, encrypting data so it stays protected even while the GPU is actively processing it. The Google Cloud implementation stacks three vendors: NVIDIA Confidential Computing on Blackwell GPUs, Intel CPUs with TDX (Trust Domain Extensions), and Google's Titan security chip ^[2]. NVIDIA's contribution adds hardware-rooted trust, encrypted communication paths, and remote attestation so a device can verify what code is actually running before it sends any data ^[3]. Crucially, Apple retains the anchor: Apple devices will only trust PCC software that Apple has cryptographically approved, and Apple maintains a verifiable, append-only ledger of every piece of Google Cloud hardware in the PCC fleet, with PCC binaries published for public inspection and researcher access to live nodes ^[1][6]. The bet is that hardware isolation plus attestation makes the question of who owns the data center irrelevant.

The expansion is not ideological, it is capacity-driven. The new infrastructure exists to serve AFM 3 Cloud Pro, Apple's most capable server model, built for agentic tool use and complex reasoning ^[4]. Apple states plainly that it worked with Google and NVIDIA to extend PCC to NVIDIA GPUs in Google Cloud specifically for that model, while keeping its privacy guarantees intact ^[4]. The scale tells the story: the heaviest Siri reasoning routes to a custom roughly 1.2-trillion-parameter model built on Google's Gemini technology and running on NVIDIA Blackwell B200 GPUs ^[5]. Siri now operates as a three-tier router, with simple tasks staying on-device, moderate requests going to Apple's own PCC servers, and the most demanding reasoning routed to Google Cloud ^[5]. Federighi's framing draws a hard line around the borrowed Gemini lineage: "We use none of the models that Google deploys to its customers" ^[5]. The full operational protections on Google Cloud are expected to be in place by the end of summer 2026 ^[2].

Community reaction split along a clean fault line. One camp reads any reliance on a competitor's servers as a betrayal of Apple's long-standing 'only on our own infrastructure' positioning, and some users want an explicit local-only mode rather than further blurring of on-device versus cloud. The opposing, more technically grounded camp treats it as ordinary cloud economics, the cloud is just someone else's computer, and argues that confidential computing keeps data-in-use encrypted such that the host operator cannot see it. NVIDIA's own framing supports the rebuttal: with Confidential Computing, no one, not even the system's builders, can view user data, chats, or conversations, even outside Apple's hardware ^[3]. The unresolved tension is one of trust posture rather than disclosed vulnerability: Apple's guarantees now rest on the correctness of a multi-vendor hardware stack and the integrity of its attestation chain rather than on physical exclusivity. A recurring observer prediction is that the same data-in-use encryption could eventually let Apple migrate to cheaper inference accelerators, suggesting Google Cloud is a beachhead rather than a final destination.