A data center comprising: a plurality of secure processing units; a plurality of data stores holding encrypted data records; and a network connecting the secure processing units and the data stores, wherein the secure processing units are configured to execute a data processing operation in parallel by being configured to read encrypted records from the plurality of data stores, process one or more of the encrypted data records within the secure processing units, send one or more of the encrypted data records between the secure processing units over the network, and write the encrypted data records to the plurality of data stores, wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers and where the mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the secure processing units, wherein the data processing operation is configured to carry out a secret shuffle of at least some of the encrypted data records to protect privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted records; wherein the secret shuffle comprises a random permutation of the encrypted data records hidden from the observer, and wherein the plurality of secure processing units include a plurality of additional mappers and additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle. a plurality of secure processing units; a plurality of data stores holding encrypted data records; and a network connecting the secure processing units and the data stores, wherein the secure processing units are configured to execute a data processing operation in parallel by being configured to read encrypted records from the plurality of data stores, process one or more of the encrypted data records within the secure processing units, send one or more of the encrypted data records between the secure processing units over the network, and write the encrypted data records to the plurality of data stores, wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers and where the mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the secure processing units, wherein the data processing operation is configured to carry out a secret shuffle of at least some of the encrypted data records to protect privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted records; wherein the secret shuffle comprises a random permutation of the encrypted data records hidden from the observer, and wherein the plurality of secure processing units include a plurality of additional mappers and additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle.