A secure start system for an autonomous vehicle (AV) can include a compute stack and a communications router. The communications router can include an encrypted router drive and an input interface to receive a boot-loader that includes a basic decryption key to decrypt the encrypted router drive and enable network communications with a backend system. The secure start system can utilizes a tunnel key from the backend system to establish a private communications session with a backend data vault, and retrieve a set of decryption keys from the backend data vault, via the private communications session, to decrypt a plurality of encrypted drives of the AV.