A system comprising a storage array comprising one or more storage devices (135A-n); and a storage controller coupled to the storage array, the storage controller comprising a processing device, the processing device to: receive a first request from a first client device (115, 125) to write a first encrypted data to a logical volume resident on a storage array, wherein the first encrypted data comprises a first data encrypted by a first encryption key, wherein the first encryption key is associated with the logical volume; determine a first decryption key to decrypt the encrypted data, wherein the first decryption key is associated with the logical volume, and wherein determining the first decryption key comprises accessing a key mapping table that maps an identifier of the logical volume to the first decryption key; decrypt the encrypted data using the first decryption key to generate a first decrypted data; perform at least one of a data deduplication operation or a data compression operation on the first decrypted data to generate a first reduced data; encrypt the first reduced data using a second encryption key to generate a second encrypted data, wherein the second encryption key is associated with at least one property of the storage array; and store the second encrypted data to the logical volume on the storage array. a storage array comprising one or more storage devices (135A-n); and a storage controller coupled to the storage array, the storage controller comprising a processing device, the processing device to: receive a first request from a first client device (115, 125) to write a first encrypted data to a logical volume resident on a storage array, wherein the first encrypted data comprises a first data encrypted by a first encryption key, wherein the first encryption key is associated with the logical volume; determine a first decryption key to decrypt the encrypted data, wherein the first decryption key is associated with the logical volume, and wherein determining the first decryption key comprises accessing a key mapping table that maps an identifier of the logical volume to the first decryption key; decrypt the encrypted data using the first decryption key to generate a first decrypted data; perform at least one of a data deduplication operation or a data compression operation on the first decrypted data to generate a first reduced data; encrypt the first reduced data using a second encryption key to generate a second encrypted data, wherein the second encryption key is associated with at least one property of the storage array; and store the second encrypted data to the logical volume on the storage array. receive a first request from a first client device (115, 125) to write a first encrypted data to a logical volume resident on a storage array, wherein the first encrypted data comprises a first data encrypted by a first encryption key, wherein the first encryption key is associated with the logical volume; determine a first decryption key to decrypt the encrypted data, wherein the first decryption key is associated with the logical volume, and wherein determining the first decryption key comprises accessing a key mapping table that maps an identifier of the logical volume to the first decryption key; decrypt the encrypted data using the first decryption key to generate a first decrypted data; perform at least one of a data deduplication operation or a data compression operation on the first decrypted data to generate a first reduced data; encrypt the first reduced data using a second encryption key to generate a second encrypted data, wherein the second encryption key is associated with at least one property of the storage array; and store the second encrypted data to the logical volume on the storage array.