I have often argued that personal AI memory should remain local.
I would now make that sentence more precise.
Memory does not always have to stay on your device. Control over it should stay with you.
On 23 September, Google described a planned server-side memory layer for Private AI Compute: encrypted storage, keys held on personal devices, and processing inside secure enclaves. Meta described persistent memory for AI glasses using user-provided keys and remotely verified confidential processing.
These are published architectural descriptions, not a blanket guarantee of privacy or independence.
But they sharpen an important distinction: Storage location is not custody.
A provider may store encrypted records without being able to read their contents. Conversely, a box in my house is not automatically under my control if someone else controls its keys, software or only usable export path.
This is not a new cryptographic idea. It is an existing distinction becoming more important as AI systems retain personal history.
For me, custody must be evaluated across the whole lifecycle.
Can I recover my memory if I lose a device? Can I export it in a usable form and move to another provider? Who can authorize new uses or change the code that processes it? What remains exposed through metadata?
Those are questions to test, not features I assume either announcement has settled.
Encryption matters. So does the software allowed to decrypt. Verifying which code is running does not, by itself, prove that everything the code does is acceptable.
And confidential storage does not guarantee continued access.
A safe-deposit box can stand outside my home. But holding its key is little comfort if I cannot enter the building and have no other copy.
That is why I am not abandoning local-first.
I still want offline operation, independent recovery and a usable way out. Those requirements cannot be replaced by a reassuring word like “private.”
In my research on long-lived AI, I would keep three questions separate:
Where is memory stored? Who controls access and permitted use? What authority exists to act on it?
Permission to recall a private conversation is not permission to send an email, spend money or disclose it to someone else.
The cloud can provide storage and computation without being granted every role in the relationship.
So the correction is not “cloud good, local unnecessary.”
It is more precise: Local-first is a valuable design choice. Custody is a requirement that must be demonstrated.
The question is not only where my memory lives.
It is what remains under my control when the device, model or provider changes.