A method of securely storing data in a nonvolatile memory array comprising: transforming a portion of data (A0, A1, A2, A3,...) according to a first transformation to obtain first transformed data (A0', A1', A2', A3',...); storing the first transformed data in a first portion of the memory array; transforming the portion of data (A0, A1, A2, A3,...) according to a second transformation to obtain second transformed data (A0*, A1*, A2*, A3*,...); storing the second transformed data in a second portion of the memory array while the first transformed data is stored in the first portion of the memory array, to provide redundant storage of the portion of data; CHARACTERISED BY: subsequently, in response to attempting to read the first transformed data from the first portion of the memory array and determining that the first transformed data (A2') is uncorrectable by error correction code, reading the second transformed data (A2*) from the second portion of the memory array; and using the second transformed data (A2*) to recover the portion of data and subsequently transforming the portion of data according to a third transformation to obtain third transformed data (A2**), storing the third transformed data in a third portion of the memory array and erasing the stored first transformed data (A2'), wherein the first, second and third transformations are different. transforming a portion of data (A0, A1, A2, A3,...) according to a first transformation to obtain first transformed data (A0', A1', A2', A3',...); storing the first transformed data in a first portion of the memory array; transforming the portion of data (A0, A1, A2, A3,...) according to a second transformation to obtain second transformed data (A0*, A1*, A2*, A3*,...); storing the second transformed data in a second portion of the memory array while the first transformed data is stored in the first portion of the memory array, to provide redundant storage of the portion of data; CHARACTERISED BY: subsequently, in response to attempting to read the first transformed data from the first portion of the memory array and determining that the first transformed data (A2') is uncorrectable by error correction code, reading the second transformed data (A2*) from the second portion of the memory array; and using the second transformed data (A2*) to recover the portion of data and subsequently transforming the portion of data according to a third transformation to obtain third transformed data (A2**), storing the third transformed data in a third portion of the memory array and erasing the stored first transformed data (A2'), wherein the first, second and third transformations are different. subsequently, in response to attempting to read the first transformed data from the first portion of the memory array and determining that the first transformed data (A2') is uncorrectable by error correction code, reading the second transformed data (A2*) from the second portion of the memory array; and using the second transformed data (A2*) to recover the portion of data and subsequently transforming the portion of data according to a third transformation to obtain third transformed data (A2**), storing the third transformed data in a third portion of the memory array and erasing the stored first transformed data (A2'), wherein the first, second and third transformations are different.