A hybrid-cloud data storage method, executed by a gateway in a private cloud, wherein the private cloud is a cloud environment exclusive to specific users for security, the private cloud comprises an encryption chip connected with the gateway, and the encryption chip stores a key for data encryption, the hybrid-cloud data storage method comprising: receiving a data storage instruction from a terminal device in the private cloud, wherein the data storage instruction includes data to be stored in a public cloud; acquiring the data to be stored; determining whether an encryption chip or the gateway implements encryption; if the encryption is implemented by the encryption chip, determining data required to be encrypted in the data to be stored to obtain first target data, transmitting the first target data to the encryption chip to acquire a first encrypted data obtained after the encryption chip encrypts the first target data according to the stored key, generating second target data including the first encrypted data according to the first encrypted data, generating a data segment corresponding to the second target data according to the second target data, and transmitting the data segment corresponding to the second target data to the public cloud for storage; and if the encryption is implemented by the gateway, encrypting the data to be stored according to the key provided by the encryption chip within a set life cycle to obtain a second encrypted data, wherein the set life cycle is kept for the key, after requesting the encryption chip for the key once, a new key from the encryption chip is requested only after the set life cycle of the last stored key in the gateway is exceeded, generating a data segment corresponding to the second encrypted data according to the second encrypted data, and transmitting the data segment corresponding to the second encrypted data to the public cloud for storage. receiving a data storage instruction from a terminal device in the private cloud, wherein the data storage instruction includes data to be stored in a public cloud; acquiring the data to be stored; determining whether an encryption chip or the gateway implements encryption; if the encryption is implemented by the encryption chip, determining data required to be encrypted in the data to be stored to obtain first target data, transmitting the first target data to the encryption chip to acquire a first encrypted data obtained after the encryption chip encrypts the first target data according to the stored key, generating second target data including the first encrypted data according to the first encrypted data, generating a data segment corresponding to the second target data according to the second target data, and transmitting the data segment corresponding to the second target data to the public cloud for storage; and if the encryption is implemented by the gateway, encrypting the data to be stored according to the key provided by the encryption chip within a set life cycle to obtain a second encrypted data, wherein the set life cycle is kept for the key, after requesting the encryption chip for the key once, a new key from the encryption chip is requested only after the set life cycle of the last stored key in the gateway is exceeded, generating a data segment corresponding to the second encrypted data according to the second encrypted data, and transmitting the data segment corresponding to the second encrypted data to the public cloud for storage.