Apple Expands Private Cloud Compute onto Google Cloud Infrastructure

Apple's Private Cloud Compute (PCC) platform is expanding beyond Apple-operated hardware, with Google Cloud confirmed as a hosting partner during WWDC 2026. The two companies, working alongside Intel and NVIDIA, have built a serving platform designed to satisfy PCC's security, confidentiality, and auditability requirements.

How the stack is constructed

The foundation of the deployment is Google Cloud's Confidential Computing portfolio. Hardware-based Trusted Execution Environments (TEEs) keep workload data encrypted while it is actively being processed — a property distinct from encryption at rest or in transit. Google pairs this with its Titanium security architecture, which centers on the custom-designed Titan chip. That chip establishes a hardware root of trust from the point a server boots, giving downstream software a verifiable foundation to build upon.

For AI inference specifically, the implementation uses Intel Trust Domain Extensions (TDX) on the CPU side and NVIDIA Confidential Computing on the GPU side, with NVIDIA Blackwell hardware cited as the GPU platform. The intent is that the entire compute path — from initial CPU processing through GPU inference — remains inside a protected boundary, reducing the attack surface for any actor attempting to inspect or intercept workload data.

Beyond hardware, Apple and Google co-engineered an open-source host stack expressly to support PCC's transparency requirements. Because the software is publicly available for inspection, third parties can independently verify the security properties of the system rather than relying solely on vendor assertions. Google describes the design goal as providing enforceable protections with no privileged runtime access — meaning even Google Cloud operators cannot reach into running PCC workloads.

Relevance to cloud and infrastructure professionals

For providers and engineers working in confidential computing, the collaboration is a large-scale production deployment of a multi-vendor TEE stack: Intel TDX for CPU isolation, NVIDIA's confidential GPU mode for accelerator-side protection, and a silicon root of trust via a proprietary chip — all in a single pipeline. That combination has been discussed in the industry for some time; this deployment gives it a high-profile, externally auditable reference architecture.

The open-source host stack component is notable for managed-service and sovereign-cloud operators. Customers with strict audit requirements increasingly ask for verifiable transparency rather than contractual guarantees alone. An open, inspectable software layer that sits beneath a confidential workload could become a template for other regulated or privacy-sensitive deployments.

Google states that the engineering work done for the Apple collaboration will flow into its general Confidential Computing offering, meaning features developed to meet Apple's requirements will eventually be accessible to other Google Cloud customers. That trajectory is relevant for product teams evaluating whether confidential computing can support their own sensitive AI inference workloads without requiring a bespoke arrangement.