Private Cloud Compute explained: Apple's private AI cloud

Private Cloud Compute is Apple's server system for Apple Intelligence requests that are too large for the device. It runs on Apple silicon servers, uses personal data just to answer the request and, Apple says, keeps none of it afterward. Apple publishes its software so researchers can check those claims.

Apple announced Private Cloud Compute, often shortened to PCC, in 2024 alongside Apple Intelligence. It answers a practical problem. Small models run well on a phone or laptop, but some requests need a larger model than the device can hold. Sending those requests to a conventional cloud service would mean trusting the provider's policies. PCC is Apple's attempt to make the cloud side behave, as far as possible, like an extension of the device.

Where PCC fits

Path	Where the model runs	What happens to the data
On device	On your iPhone, iPad or Mac	Stays on the device
Private Cloud Compute	Apple silicon servers run by Apple	Used for the request, then deleted, according to Apple
Optional third-party models	The third party's own servers	Follows that provider's terms, which Apple describes separately

Apple Intelligence handles many requests on the device and decides when a request needs a larger model in PCC. Optional integrations with other companies' models, such as OpenAI's, are a different path: they are turned on separately and follow their own privacy terms. The guide to what Apple Intelligence runs on your device covers the on-device side.

The five requirements Apple set

Apple's security research team described PCC through five requirements. In plain terms:

• Stateless computation. Personal data is used to fulfill the request and is not retained once the response is returned.
• Technical enforcement. The privacy promises are meant to be enforced by the system's technical design, not by policy alone.
• No privileged runtime access. There is no remote shell or interactive debugging on production nodes, and logging is limited to pre-specified, audited metrics. Apple says user data is not available to Apple, including staff with administrative access.
• Non-targetability. An attacker should not be able to aim at one person's requests without a broad attack that would be likely to be detected.
• Verifiable transparency. Security researchers should be able to check that the software running in production is the software Apple published.

How a request travels

1. The device decides. Apple Intelligence works out whether the request can be handled on the device. If not, it prepares a request for PCC with just the data the task needs.
2. The device encrypts. The request is encrypted to the public keys of PCC nodes the device has validated, so load balancers and gateways along the way cannot read it.
3. A relay hides the address. The request passes through a relay operated by a third party, which hides the device's IP address from Apple's infrastructure.
4. A node answers. A PCC node decrypts the request, runs the model and returns the response.
5. The data is discarded. According to Apple, the node keeps no user data after the response, and the keys that protect its storage change on every restart.

Why researchers can check it

The unusual part of PCC is the transparency commitment. Apple publishes the software images of production PCC builds in a public log that entries can be added to but not rewritten, and devices are designed to send requests just to nodes running software that appears in that log. In 2024 Apple also released a security guide and a Virtual Research Environment that lets researchers inspect PCC software on a Mac, and added PCC to the Apple Security Bounty.

This does not mean anyone can audit every server in real time. It means the claims are open to outside scrutiny in a way that the privacy policies of many cloud services are not.

What PCC means for business data

• It covers Apple's own models. PCC is the cloud half of Apple Intelligence. It says nothing about the AI services a business app uses on its own.
• Other AI services work differently. When a business tool connects to an AI provider with an API key, the data goes to that provider under that provider's terms. The guide to what business data an AI assistant sends explains what to check, and bringing your own AI key explains who that provider relationship belongs to.
• Cost is not metered per request. Apple Intelligence is part of the operating system on supported devices, while API-based AI is usually billed by usage; see what AI costs when you bring your own key.
• Policies still matter. Organizations can restrict some Apple Intelligence features on managed devices, and many have rules about what data may be sent to any AI service. PCC changes the risk, not the need for a policy.

Frequently asked questions

Does Apple store my Private Cloud Compute requests?

Apple says no. According to Apple's security research pages, personal data is used to fulfill the request and is not retained afterward, and the system is designed so that data cannot persist on the servers.

Can Apple employees see data sent to Private Cloud Compute?

Apple says user data is not available to Apple, including staff with administrative access to the servers. The design removes remote shells and interactive debugging, and limits logging to pre-specified metrics.

How do I know when a request leaves my device?

Apple documents an Apple Intelligence Report in the Privacy & Security settings that lists requests sent to Private Cloud Compute over a recent period. It shows when the cloud was used, though not every detail of what the model did.

Is Private Cloud Compute the same as iCloud?

No. iCloud stores your data so you can use it across devices. Private Cloud Compute processes a request and, according to Apple, keeps nothing once it has answered.