---
title: Apple Silicon Node Architecture
framework: Private Cloud Compute Security Guide
role: article
role_heading: Article
path: private-cloud-compute/applesiliconnodearchitecture
---

# Apple Silicon Node Architecture

A node combines custom server hardware with a hardened subset of iOS, and measures the software it runs.

## Overview

Overview To support Apple Intelligence workloads that require models too large to run on device, we brought the power and security of Apple silicon to the data center with custom server hardware, using the same hardware security technologies found in Apple devices, including the Cryptographic identity and Secure Boot. We paired that hardware with a purpose-built operating system: a hardened subset of the foundations of iOS and macOS, tailored to inference workloads while presenting an extremely narrow attack surface. A node satisfies PCC’s Core Security and Privacy Requirements using Apple Silicon Software Foundations and a stack of signed, measured cryptexes. User data is released only to nodes that present attested measurements matching a release recorded in the Release Transparency. Custom server hardware Apple designs and operates custom server hardware dedicated to Private Cloud Compute. Multiple nodes sit within each server chassis alongside an Apple silicon baseboard management controller (BMC), which manages system state and provisions configuration over chassis-internal networking. Each node runs directly on bare metal as the sole tenant: the operating system runs on the hardware with no hypervisor beneath it, and no other workload shares the node. That leaves no virtualization layer to escape and no co-resident workload from which to mount a microarchitectural side-channel attack. Apple silicon The hardware roots its security in two main components of the Apple silicon System-on-Chip (SoC): PCC nodes run in Ephemeral Data Mode: the Secure Enclave randomizes the data volume’s storage-key hierarchy at every boot, so no data written in one boot session is readable in the next. Node software PCC nodes run a minimal operating system based on iOS and macOS, and layer PCC software above it as Cryptexes. The node’s software stack includes: During boot, darwin-init configures the node, activates the cryptexes, and ratchets their manifests into the Secure Enclave before entering Restricted Execution Mode. Apple Silicon Node Attestation reports this measured state, which Node validation checks against the transparency log before any user data reaches the node.