Google Is Building AI Memory Designed to Stay Locked Even From Google

Google is developing AI memory that remains inaccessible to the company, even from within its own ranks. The company's Private AI Compute architecture, unveiled by DeepMind on September 23, aims to retain personalized context across various devices while ensuring encryption keys remain within the user's possession. This design would keep stored information unreadable to Google, although no rollout date has been announced and it is not yet a generally available Gemini memory feature.

Persistent memory could enhance AI assistants by maintaining context across sessions and devices. However, it also raises concerns about the security and privacy of potentially sensitive data. Introduced in November 2025, Private AI Compute allows Google AI features to utilize Gemini models within a hardware-isolated cloud environment.

The new persistent-memory architecture would add encrypted storage for each user, with decryption keys remaining on the user's device. When an AI model requires stored context, it would be transferred through an authenticated, end-to-end encrypted channel into a secure enclave, where it would be decrypted temporarily for processing and then re-encrypted before storage.

Google's architecture also employs encrypted channels, per-user databases, and device-derived keys. Devices will verify the authenticity and integrity of server software before sending personal data. While Google has commissioned Trail of Bits to assess the server-side memory feature, the security review found several issues, including two high-severity, one medium-severity, two low-severity, and five informational findings.

Notably, there is no mechanism that allows Google employees to access user data. However, the system does not guarantee that deleted memory cannot be restored under certain privileged conditions. Encryption and enclave protections do not prevent compromised user devices or misuse of legitimately granted permissions. Google's "even Google" claim specifically pertains to operator access to stored memory, not to other potential exposure avenues.

Availability, device support, account recovery, deletion behavior, and enterprise controls remain unresolved. The eventual product's alignment with Google's described architecture will become clearer as these details are addressed.