What is private cloud AI, and how does it differ from on-device AI?

There is a basic conflict at the heart of personal AI. The best models are too large for your phone, so they run on a company's servers. But to answer you, those servers need to read your request in plain form. Ordinary encryption protects data in transit and at rest, not while it is being processed. Apple put it directly in 2024: cloud AI requires unencrypted access to the user's request, which rules out end-to-end encryption, the method that lets apps like iMessage keep even the operator out.

Private cloud AI is the industry's attempt to get around that. It does not remove the problem, as we will see, but it does change who you have to trust and how.

The ladder of privacy

It helps to picture the options as a ladder.

Each step up brings larger models and more convenience. Each step down brings more control.

How a sealed cloud works

The key tool is a trusted execution environment (TEE), a walled-off area of a processor whose contents are protected even from the rest of the machine. Around it, the designs share a handful of ideas, which Apple set out most fully in its 2024 security post:

• Stateless processing. Your data is used to answer the request and deleted right after, with no logs.
• No administrator back door. Apple says it removed tools such as remote shells, so its own staff cannot look inside even during an outage.
• Non-targetability. Going after one particular person should require breaking the whole system.
• Attestation. Before sending anything, your device checks a cryptographic fingerprint of the software on the server, and refuses to talk to it if it does not match a published version.
• Verifiable transparency. Outsiders can inspect the software images that the fingerprints point to, so the promise can be tested.

The attestation step is what separates this from a privacy policy. Instead of taking a company's word that it does not log your data, your device checks which code is running. Think of a sealed exam room with a window: you cannot see the answers, but you can confirm who is inside and which rules are posted on the wall.

Google announced a similar system, Private AI Compute, in November 2025, running Gemini models on its own TPU chips, with features on Pixel phones among the first uses. It says the data remains inaccessible even to Google. Meta described Private Processing for WhatsApp in April 2025 on the same principles, for optional features such as message summaries.

Apple's approach matters more now that Siri is changing. In June 2026 Apple announced Siri AI, using its models on device and on Private Cloud Compute, and said personal data handled there is neither stored nor accessible to Apple. Our article on the new Siri looks at what that changes day to day. French support arrived with iOS 27.2 on October 26, and Apple's Canadian French page lists Siri AI in French, as a beta with conditions that vary by device and region.

What the audits show

These claims can be tested, and when they are, problems turn up. The security firm Trail of Bits audited WhatsApp's system before launch and reported 28 issues, eight of them high severity. In one, configuration values were loaded after the fingerprint was taken, so a malicious insider could have run altered code while the attestation still looked valid. In another, hardware configuration tables were left out of the measurement. Before launch, the firm says, Meta fully resolved 16 of the issues and partly addressed four, and chose not to address the remaining eight, which were of low or informational severity.

Two lessons follow. The design works only if every detail is right, since one unmeasured file can undo the guarantee. And it is hard for a user to check independently: the audit shows that experts looking closely found serious flaws, and also that you depend on such experts to look. Equally detailed independent audits of Apple's and Google's systems are harder to come by, though Apple publishes material for researchers. The lack of such a report is not evidence of a flaw, and it is not proof of soundness either.

Where agents strain the model

Private cloud designs suit single requests: send, answer, forget. A personal agent is the opposite. It remembers you, holds login credentials and works for hours. As Meredith Whittaker of Signal warned in 2025, agents need broad access, probably in the clear on a cloud server.

Current agents show the gap. Meta says Muse keeps data and credentials on a dedicated VM and that the agent itself cannot see passwords, and that a future Confidential VM will be encrypted with a key only you hold, "so not even Meta can access it." That is still a promise: on its October earnings call, Zuckerberg said Meta is working on it, and Memeburn reported on October 24 that it had not shipped. Anthropic says Claude Duet never directly sees your passwords or tokens, and that approvals and logins run in your own cloud computer. Those protect credentials from the model; they are not the same as hiding your data from the company. A stateless server and a remembering agent pull against each other, and how far encryption can close that gap is an open question.

When should you trust a private cloud over a local model?

Use a local model when the data must not leave your hands, or when you need certainty that does not depend on anyone's implementation. A small model on your own machine has a simple trust story, as long as your device is secure and no plugin sends the data elsewhere. The cost is capability: our guide to AI on phones shows what fits.

A private cloud is reasonable when you need a stronger model for personal material, such as summarizing messages or searching your own documents, and when the feature is built on a design with published details. It is a real improvement over an ordinary cloud service. Whether it meets a legal or professional duty is another matter. Health, legal or Quebec Law 25 obligations still depend on your contract and on where the data goes, so ask your provider or counsel.

Reserve your strongest caution for ordinary cloud services and agents holding credentials. Companies' assurances there rest more on policy than on checkable design, at least until they ship and let outsiders test what they promised.