A method for a data deduplication and compression in an untrusted storage system, the method comprises: - defining a first set of trusted servers, wherein each trusted server of the first set of trusted servers is configured to use a first encryption key and a first hash function; - separating the data in the trusted servers into blocks having fixed aligned sizes according to a block size of the data in the untrusted storage system for compression; - calculating a first hash value of the data; - compressing the data of each block on the server of the first set of trusted servers; - encrypting the compressed data by using the first encryption key; - executing a write function via an application program interface, API, by sending the compressed encrypted data, a key ID of the first encryption key and the first hash value from the one or more trusted servers of the first set of trusted servers to a storage array of the untrusted storage system; - executing a read function via the API by decrypting by the server the data of each block with a key matching the key ID of the first encryption key and decompressing the data; - wherein the executing the write function further comprises using the first hash value and the key ID at the storage array for identifying whether the first hash value already exists in the storage array for the first set of trusted servers, and if the first hash value does not exist in the storage array the compressed encrypted data is stored at the storage array of the untrusted storage system, and if the first hash value exists in the storage array the compressed encrypted data is not stored at the storage array of the untrusted storage system; - wherein executing the write function at the storage array further comprises identifying whether the key ID of the first encryption key has changed; and - wherein if the key ID of the encryption key has not changed, the method further comprises storing from the write function, by the untrusted storage (106A, 302, 400), the pointer to the location of the data; or if the key ID of the encryption has changed, the method further comprises replacing at the storage array, the data encrypted with the first encryption key with the data encrypted with the changed encryption key and updating a data of a key ID of the changed encryption key. - defining a first set of trusted servers, wherein each trusted server of the first set of trusted servers is configured to use a first encryption key and a first hash function; - separating the data in the trusted servers into blocks having fixed aligned sizes according to a block size of the data in the untrusted storage system for compression; - calculating a first hash value of the data; - compressing the data of each block on the server of the first set of trusted servers; - encrypting the compressed data by using the first encryption key; - executing a write function via an application program interface, API, by sending the compressed encrypted data, a key ID of the first encryption key and the first hash value from the one or more trusted servers of the first set of trusted servers to a storage array of the untrusted storage system; - executing a read function via the API by decrypting by the server the data of each block with a key matching the key ID of the first encryption key and decompressing the data; - wherein the executing the write function further comprises using the first hash value and the key ID at the storage array for identifying whether the first hash value already exists in the storage array for the first set of trusted servers, and if the first hash value does not exist in the storage array the compressed encrypted data is stored at the storage array of the untrusted storage system, and if the first hash value exists in the storage array the compressed encrypted data is not stored at the storage array of the untrusted storage system; - wherein executing the write function at the storage array further comprises identifying whether the key ID of the first encryption key has changed; and - wherein if the key ID of the encryption key has not changed, the method further comprises storing from the write function, by the untrusted storage (106A, 302, 400), the pointer to the location of the data; or if the key ID of the encryption has changed, the method further comprises replacing at the storage array, the data encrypted with the first encryption key with the data encrypted with the changed encryption key and updating a data of a key ID of the changed encryption key.