Apple Private Cloud Compute Security Guide

This document is Apple's Private Cloud Compute (PCC) Security Guide, a technical governance document describing the architecture, security properties, and privacy guarantees of the cloud infrastructure used to process Apple Intelligence requests that cannot be handled on-device. The guide states that PCC is designed around four core requirements: stateless computation on personal data (the system is designed so that user data is not retained after a request is fulfilled), no privileged runtime access (Apple personnel cannot access user data or request fulfillment infrastructure at runtime), non-targetability (requests cannot be directed at specific individuals by any party including Apple), and verifiable transparency (the software running on PCC nodes is publicly inspectable via a transparency log and virtual research environment). The document describes hardware-rooted trust chains, Secure Enclave-based attestation, cryptographic request routing, and software-enforced isolation as the primary technical mechanisms enforcing these guarantees, which is operationally distinct from most cloud AI provider disclosures in its specificity and its commitment to third-party verifiability. The document engages with EU AI Act considerations around high-risk AI system transparency and auditability, GDPR data minimization and purpose limitation principles given the EU user base, and FTC Act Section 5 considerations around unfair or deceptive practices given the privacy assurances made to consumers. The verifiable transparency commitment, which includes publishing signed software measurements to a publicly auditable append-only log and providing a Virtual Research Environment for independent security researchers, creates a materially observable compliance baseline that may be referenced in regulatory assessments across jurisdictions.