Abstract: Systems, methods, and media may provide secure data storage. A request may be transmitted for a requested container to a database, the request comprising a requested container identifier of the requested container. The database may comprise containers, wherein each container is identified by a container identifier and comprises at least one record, a container session key table configured to store the container identifiers of the containers, a container session key share table configured to store encrypted user keys, and a container session key table configured to store session key shares, wherein each session key share corresponds to at least one encrypted user key. The requested container may be received from the database, and the database may provide the requested container by using the container session key table to identify the requested container.