diff --git a/internal/pkg/service/stream/encryption/log.go b/internal/pkg/service/stream/encryption/log.go
index 819895cbce..36f5f06680 100644
--- a/internal/pkg/service/stream/encryption/log.go
+++ b/internal/pkg/service/stream/encryption/log.go
@@ -6,6 +6,7 @@ import (
 	"github.com/keboola/go-cloud-encrypt/pkg/cloudencrypt"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/log"
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
 // LoggedEncryptor wraps another Encryptor and adds logging.
@@ -22,6 +23,12 @@ func NewLoggedEncryptor(ctx context.Context, encryptor cloudencrypt.Encryptor, l
 }
 
 func (encryptor *LoggedEncryptor) Encrypt(ctx context.Context, plaintext []byte, metadata cloudencrypt.Metadata) ([]byte, error) {
+	if len(plaintext) == 0 {
+		err := errors.New("text should not be empty")
+		encryptor.logger.Infof(ctx, "encryption error: %s", err.Error())
+		return nil, err
+	}
+
 	encryptedValue, err := encryptor.encryptor.Encrypt(ctx, plaintext, metadata)
 	if err != nil {
 		encryptor.logger.Infof(ctx, "encryption error: %s", err.Error())
@@ -34,6 +41,12 @@ func (encryptor *LoggedEncryptor) Encrypt(ctx context.Context, plaintext []byte,
 }
 
 func (encryptor *LoggedEncryptor) Decrypt(ctx context.Context, ciphertext []byte, metadata cloudencrypt.Metadata) ([]byte, error) {
+	if len(ciphertext) == 0 {
+		err := errors.New("text should not be empty")
+		encryptor.logger.Infof(ctx, "decryption error: %s", err.Error())
+		return nil, err
+	}
+
 	plaintext, err := encryptor.encryptor.Decrypt(ctx, ciphertext, metadata)
 	if err != nil {
 		encryptor.logger.Infof(ctx, "decryption error: %s", err.Error())