where to keep the AES keystream?
You should never keep keystreams. You should keep a key, and store an IV or Nonce with the ciphertext. You first need to think about where to store the key, if you store it in the same location or with the same security as your ciphertext, your scheme is meaningless.

Check this answer I just created on Stackoverflow, and learn about key management. This answer on the Information Security site also seems very on topic for you.