In a Google DeepMind post dated September 23, 2026, Google set out how it "will bring private, server-side memory" to Private AI Compute, its cloud processing platform for personal AI requests. Until now the platform was stateless: context was wiped as soon as a task ended. That is safe, but it stops an assistant from carrying continuity across devices. Google's examples are pulling up on a laptop the assembly instructions you looked at through smart glasses, and resuming a complex conversation when you move from phone to web.
The design keeps memory in per-user encrypted databases in the cloud, but the keys are derived from and held on the user's own devices. When a model needs that memory, the device opens an authenticated, end-to-end encrypted channel to a hardware-enforced secure enclave. The enclave decrypts the data only inside isolated memory, serves the request, saves any new context, and re-encrypts it. Google says the stored data is inaccessible to anyone else, including Google. Verification is meant to come from a tamper-proof public record of the server software. Devices will check that the software is authentic before sending personal data, and Google cites an independent audit by a cybersecurity firm.
The engineering significance is that it attacks the central trade-off in agent memory. Useful agents need durable, cross-session state; durable state in a provider's cloud is exactly what privacy-sensitive users and regulated enterprises have refused. Device-held keys plus attested enclaves let a provider offer persistence without custody, if the attestation chain holds. The same shape applies well beyond consumer assistants. Any enterprise agent that remembers customers or employees faces the same question of who can read the memory store.
What remains open: the post gives no launch date and names no specific products, and it lists no limitations. Enclave-based designs have a history of side-channel research findings, and "the provider can't read it" depends on attestation details that outside researchers have not yet examined. Key recovery is unaddressed: if the only keys live on your devices, losing all of them may mean losing the memory.
Google's design offers persistence without provider custody -- device-held keys and attested enclaves -- which is the right shape for agent memory, but it is announced, not shipped, and its guarantees rest on attestation that still needs outside scrutiny.