A secure data mirroring capability in a storage system includes encrypting data blocks in a primary volume in preparation for a data mirroring operation. The encrypted data blocks are mirrored to a secure secondary volume. Host systems provide keys from which encryption keys are produced for encrypting the data blocks. Access to data on the secure secondary volume requires decryption using the key that was used to produce the encrypted data blocks.