Google wants its AI to remember more about you without giving Google the keys to that memory.
Google DeepMind on Sept. 23 detailed a persistent-memory architecture for Private AI Compute designed to retain personal context across devices while keeping encryption keys on users’ devices. Google says that would leave stored information unreadable to the company itself, though the capability has no announced rollout date and is not yet a generally available Gemini memory feature.
Persistent memory could make AI assistants more useful by carrying context from one session or device to another. It also creates a larger store of potentially sensitive information, forcing Google to solve a difficult problem: how to use cloud-scale AI without giving the cloud operator routine access to what the assistant remembers.
How Google plans to keep AI memory private
Private AI Compute, introduced in November 2025, lets Google AI features use Gemini models in a hardware-isolated cloud environment. Until now, Google says the system has been “stateless,” discarding task context after processing ends.
The new persistent-memory architecture would add encrypted storage for each user while keeping the keys needed to unlock it on the user’s devices. When an AI model needs stored context, an authenticated, end-to-end encrypted connection would send the data into a secure enclave, where it is temporarily decrypted for processing and encrypted again before storage.
Persistent memory is also appearing across competing AI products. Anthropic recently extended Claude’s memory across Chat and Cowork, allowing context learned in one experience to carry into the other.
Google’s architecture also uses encrypted channels, per-user databases, and device-derived keys. The company says devices will be able to verify that server software is authentic and unaltered before sending personal data.
Google has not announced when persistent memory will ship, which accounts or devices will support it, or what enterprise controls will accompany it. Those controls will become especially important as Gemini Enterprise connects with business data and AI agents across platforms including Salesforce.
What Google’s security audit found
Google commissioned Trail of Bits to assess the server-side memory feature. Its Sept. 21 security review covered threat modeling and code analysis and recorded 10 findings: two high-severity, one medium-severity, two low-severity, and five informational.
Eight findings were marked resolved after fixes, while one high-severity and one low-severity issue remained open in the report’s findings table. Trail of Bits also found no mechanism in the reviewed code that would allow Google employees to access user data.
The assessment did find that the system lacked a cryptographic guarantee preventing deleted memory from being restored under certain privileged conditions. The review covered the memory addition rather than every component of Private AI Compute and noted that much of the system remains closed source.
Encryption and enclave protections also do not protect a compromised user device or prevent misuse of legitimately granted permissions. That risk is part of the broader identity and access-control challenge facing enterprise AI.
Google’s “even Google” claim therefore applies specifically to operator access to stored memory, not every possible way the data could be exposed. Protected infrastructure still temporarily decrypts the information during authorized processing.
Availability, supported devices, account recovery, deletion behavior, and enterprise controls remain unresolved. Those details will show how closely the eventual product matches the architecture Google has described.
Want to learn more AI tips, tricks, and prompting techniques? Let us teach you How to Talk to AI for free! Try our six-minute course at The Neuron Academy and learn a few simple ways to write better prompts and get more useful results from AI, or browse our other AI course for free for seven days. Check out all the lessons here →