Encryption key rotation

Various aspects of the subject technology relate to systems, methods, and machine-readable media for encrypting data. The method includes adding a new encryption key for encrypting and/or decrypting data of a database, the data previously encrypted by an old encryption key. The method also includes hashing the new encryption key to generate a new hash. The method also includes comparing the new hash and an old hash with values in an encryption log, the old hash generated by hashing an old encryption key. The method also includes in response to the comparing, decrypting the data with the old encryption key when the new hash and old hash match the values in the encryption log. The method also includes encrypting the data with the new encryption key. The method also includes adding a new entry into the encryption log, the new entry comprising the new hash.