Private Cloud Compute (PCC) is Apple's server system for Apple Intelligence requests that need larger models than a device can run.
Apple reports that user devices send a request only to servers that attest to running a software release listed in a public, append-only transparency log. Apple publishes the software images, a virtual research environment that boots them, and part of the source code. A peer-reviewed study found flaws in how PCC authenticates requests.
An independent researcher working in Apple's research environment reports that a node with tampered configuration files passed attestation until Apple fixed the underlying bug. In June 2026 Apple announced an extension of PCC to Google Cloud using Intel Trust Domain Extensions (TDX) and NVIDIA confidential computing.
Independent researchers with physical access to such hardware have forged TDX attestations and relayed NVIDIA ones (TEE.fail). These attacks were not against PCC, where Apple reports two independent roots of trust.
PCC is a production service whose attestation, transparency log and research tools are public, but no independent evaluation has examined its attestation chain as a whole.
Assessed use: showing users which software serves their AI requests, not which model
On this page
What it is
Private Cloud Compute (PCC) is Apple's server system for Apple Intelligence features that need larger foundation models than a device can run 1. Apple built it on custom servers with Apple silicon, the Secure Enclave and Secure Boot 1. Apple states that security researchers must be able to verify that PCC's privacy and security guarantees match its public promises 1.
PCC applies TEE remote attestation to show users which software handles their AI requests. It was designed to keep those requests private, and its checks concern software releases 1.
In June 2026 Apple announced that it was extending PCC to Google Cloud systems with NVIDIA GPUs, using NVIDIA confidential computing, Intel CPUs with TDX and Google's Titan chip 3. Apple stated that this deployment would reach its complete set of protections gradually during a summer preview period 3.
How it works
Apple describes the chain as follows 1:
- Every piece of code a node can run must be in a trust cache signed by Apple and loaded by the Secure Enclave, so it cannot change at runtime. Code and model assets use the integrity protection of Apple's Signed System Volume.
- Apple publishes the measurements of all code running on PCC in an append-only transparency log, and the corresponding software images within 90 days.
- A user's device encrypts each request only to the keys of nodes whose attested measurements match a release in the log.
For research, Apple publishes a Virtual Research Environment that boots PCC releases in a virtual machine on an Apple silicon Mac, checks the transparency log and runs inference against demonstration models 2. Apple also publishes source code for its attestation and request-handling components under a limited-use licence, and offers bounties of up to $1,000,000 for PCC findings 2.
Apple's threat model includes an attacker with physical access to a node who can subvert some hardware protections 1. Apple's answer is that an attacker should not be able to target particular users without compromising the whole system. It relies on a hardened hardware supply chain, including imaging each server's components before sealing it, and on routing that does not let an attacker steer chosen users' requests to a compromised node 1. On Google Cloud, Apple reports that attestation for components that could be abused to exfiltrate user data is rooted in at least two separate roots of trust from independent vendors, and that attested keys are held in a separate confidential virtual machine 3.