NVIDIA Confidential Computing to Help Expand Apple's Private Cloud Compute

Overview

NVIDIA GPUs with Confidential Computing now power server-side AI processing inside Apple's Private Cloud Compute, the privacy infrastructure behind Apple Intelligence. The change, announced around Apple's WWDC 2026 developer conference, marks the first time Apple has run this workload outside its own data centers, extending it onto Google Cloud using NVIDIA Blackwell GPUs. The goal is to handle heavier AI tasks such as agentic tool use and complex reasoning while keeping user data unreadable to anyone, including Apple, Google, and NVIDIA.

Key Takeaways

Apple's Private Cloud Compute now runs on NVIDIA Blackwell GPUs hosted on Google Cloud, the first time this privacy workload has lived outside Apple's own data centers.
NVIDIA Confidential Computing uses hardware-based trusted execution environments so that data stays encrypted and protected even while being processed during AI inference.
Apple designed the setup so no party, including Apple, Google, and NVIDIA, can read user chats, prompts, or conversations sent for server-side processing.
Security rests on a three-vendor trust stack: NVIDIA Confidential Computing on Blackwell GPUs, Intel CPUs with Trust Domain Extensions, and Google's Titan security chip.
The expansion targets heavier Apple Intelligence work such as agentic tool use and complex reasoning that a phone alone struggles to run.
Apple keeps its public verification commitments, promising published binaries, research tools, and live node access through its Security Bounty Program.

Stats & Key Facts

#About $1 billion per year is the reported value of the related Apple-Google AI deal, per Bloomberg, ranking among the largest AI licensing agreements.
#3 independent hardware vendors form the trust stack: NVIDIA, Intel, and Google.
#2 separate roots of trust from different vendors protect the most sensitive components, per Apple.
#5 core privacy principles govern PCC: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency.
#1 cryptographically verifiable hardware ledger tracks every component in the PCC fleet.

What Private Cloud Compute Does for Apple Intelligence

Private Cloud Compute is the server-side half of Apple's AI strategy.

Apple Intelligence runs many features directly on a user's iPhone, iPad, or Mac. When a request is too large or complex for the device, Apple sends it to Private Cloud Compute, a set of servers built to process that request and then forget it. PCC exists so cloud AI keeps the same privacy promises Apple makes on its own hardware.

This announcement extends PCC to handle a new class of work. Apple points to agentic tool use, where AI takes multi-step actions on a user's behalf, and complex reasoning that needs more compute than a phone holds. To run those tasks at scale, Apple needed more server capacity than its own data centers provided.

Why NVIDIA Blackwell GPUs Now Sit Inside the Privacy System

The new compute comes from NVIDIA's latest data center chips.

›NVIDIA Blackwell GPUs supply the processing power for server-side inference of Apple's foundation models.
›These GPUs run on Google Cloud rather than inside Apple-controlled facilities.
›Confidential Computing is built into the GPU hardware, not added as a separate software layer.
›The same technology supports both accelerated AI inference and training without sacrificing performance.

How Confidential Computing Keeps Data Unreadable During Processing

The core idea is protecting data even while a chip is working on it.

Most encryption protects data while it sits in storage or travels across a network. The hard part is the moment a computer reads that data to do useful work, because traditional systems decrypt it in memory where other software might see it. Confidential Computing closes that gap with a trusted execution environment, a sealed area of the chip where the data stays protected during processing.

NVIDIA's approach adds three protections that work together. Hardware-rooted trust confirms the work runs on genuine, untampered NVIDIA GPUs. Encrypted communication paths guard data as it moves between parts of the system. Remote attestation lets software check that the platform is secure before any sensitive data is released to it.

The Three-Vendor Trust Stack Behind the Expansion

Security here does not depend on a single company.

›NVIDIA Confidential Computing on Blackwell GPUs protects the AI processing itself.
›Intel CPUs with Trust Domain Extensions isolate the surrounding workload.
›Google's Titan security chip anchors trust at the server hardware level.
›Apple uses dual roots of trust from independent vendors for the most sensitive components.
›Apple retains full software control, so devices only trust Apple-approved PCC software.

What Changes for Apple's Privacy Promise on Google Cloud

Running on someone else's cloud raises an obvious question about trust.

Apple's pitch is that the privacy guarantees travel with the workload. Because data stays encrypted inside the trusted execution environment and attestation verifies the hardware first, Google as the cloud host is designed to have no ability to inspect user data or model execution. NVIDIA frames this as turning standard accelerators into trust infrastructure.

Apple also keeps its five long-standing PCC principles in place: stateless computation, enforceable guarantees, no privileged runtime access, non-targetability, and verifiable transparency. A cryptographically verifiable hardware ledger tracks every component in the fleet so the system can prove what it is running.

Apple Foundation Models, Gemini, and the WWDC 2026 Context

The models running on these GPUs come from an Apple-Google collaboration.

The server-side work uses custom Apple Foundation Models built with Google's Gemini family technology, developed jointly by the two companies. NVIDIA collaborates with both to support next-generation Apple Intelligence features tied to WWDC 2026, Apple's annual developer conference.

Reporting from Bloomberg pegs the broader Apple-Google AI arrangement at roughly $1 billion per year, placing it among the largest AI licensing deals to date. Apple said the rollout would ramp gradually through the summer, with deeper technical details promised at the Confidential Computing Summit.

Frequently Asked Questions

Does this mean Apple, Google, or NVIDIA can read my data?

No, by design. Apple states the system is built so that no one, including the companies that built it, can see user data, chats, or conversations, because the data stays encrypted inside a trusted execution environment even while it is being processed.

What is Private Cloud Compute in plain terms?

It is Apple's set of secure servers that handle Apple Intelligence requests too large to run on your device. The servers process the request and are designed to keep no record of it afterward.

Why is Apple using Google Cloud instead of its own data centers?

Apple needed more computing power to run heavier AI tasks like agentic tool use and complex reasoning. Extending Private Cloud Compute to Google Cloud on NVIDIA Blackwell GPUs gives it that capacity while keeping its privacy protections.

What is Confidential Computing?

It is a hardware security approach that protects data while a chip is actively processing it, not only while it is stored or in transit. NVIDIA builds this into its Blackwell GPUs using trusted execution environments and attestation.

Can outside researchers verify these privacy claims?

Apple says yes. It commits to publishing PCC software binaries, providing research tools, and giving researchers access to live PCC nodes through its Security Bounty Program.

The deal puts NVIDIA Blackwell GPUs and Confidential Computing at the center of Apple's privacy infrastructure, letting Apple scale heavier AI on Google Cloud without giving up its promise that user data stays private. The real test will be the technical disclosures and independent researcher reviews Apple has pledged to deliver.