The proof

Every claim on this page comes with a way to check it yourself.

Most "AI will call your leads" pitches ask you to take their word for it. We don't. Below is the short list of things NOVA actually claims — and next to each one, a file in our public repo or a curl you can run right now that proves it. No SOC 2 badge, no testimonials, no customer logos, no invented metrics. If we can't point you at proof, it isn't on this page.

The most honest thing first: NOVA does not place real outbound phone calls today. The product runs in demo mode by deliberate design — you watch it qualify a lead in your browser on the live demo, before a single dirham or a single real call is on the line. That's not a gap we're hiding; it's the reason you can trust the rest of this page. We turn real calling on only once the consent and licensing rail is cleared — not before.

The verifiable claims

01 Modern, boring auth crypto

Passwords are hashed with argon2id (the current OWASP / Password Hashing Competition winner), and session tokens are signed and verified with PyJWT (HS256) — no unmaintained python-jose, no EOL passlib. A bad login returns a clean 401, not a 500 that leaks a stack trace.

Verify this yourself

# a bad login is rejected cleanly — run it:
curl -s -o /dev/null -w "%{http_code}" \
  -X POST https://api.novalabs.ae/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"nobody@example.com","password":"wrong"}'
→ 401

In the repo: apps/api/src/api/auth/password.py (argon2id), apps/api/src/api/auth/jwt.py (PyJWT / HS256), tests in apps/api/tests/test_auth_crypto.py.

02 Secret-scanning on every commit

Every pull request and every push runs gitleaks, so an accidentally committed API key, token, or private key is caught before it reaches the main branch. It's not a policy we promise — it's a CI gate that blocks the merge.

Verify this yourself

In the repo: .github/workflows/secret-scan.yml — its own comment reads "Runs on every PR + every push." The allowlist for known false positives lives in .gitleaks.toml.

03 Honest demo mode, by design

NOVA does not auto-dial real phone numbers today. The agent ships with DEMO_MODE = "true" as a deliberate, checked-in default, so the only thing it can do right now is run a conversation in your browser. We treat that as a sales asset, not a limitation: you get to hear exactly how it qualifies a lead before anything touches a real customer.

Verify this yourself

In the repo: fly.agent.toml sets DEMO_MODE = "true". Live: open novalabs.ae/live — it's a browser-only simulation; no real phone call is placed.

04 Compliance built into the architecture — gated until licensed

The disclosure-and-consent machinery a regulated voice product needs is written into the code path, not bolted on later: a consent gate that speaks an AI-disclosure preamble and waits for permission before continuing, a deterministic do-not-call / negative-consent classifier, and an opt-out that records the request. It is live in the code (the TCPA_DISCLOSURE_ENABLED flag defaults on), and it simply has no effect today because no real PSTN calls are placed in DEMO_MODE — the gate runs the moment real calling is switched on.

To be exact about what this is and isn't: NOVA is not TDRA-certified, licensed, or approved, and this page makes no such claim. The compliance hooks are built into the architecture and gated until the licensing rail is cleared — that's a design choice we can show you in code, not a certificate we're waving.

Verify this yourself

In the repo: the consent gate lives in src/agent.py (the DisclosureAgent class) and packages/voice_agent/src/voice_agent/tcpa.py (the enable flag + negative-consent logic), with tests in packages/voice_agent/tests/test_tcpa.py. Our data-residency and PDPL-alignment roadmap is documented on the trust page — stated as a roadmap, not a certification.

05 The speed-to-lead math, sourced

The reason a sub-30-second response matters isn't our opinion — it's published industry research. A Dubai property inquiry waits roughly 4+ hours for a first response on average; a lead contacted within 5 minutes is up to 21× more likely to qualify than one contacted after 30 minutes; responding in under a minute lifts conversion by roughly +391% versus waiting two minutes.

These are publicly reported industry benchmarks and our target — cited for context, US-origin studies, explicitly not a NOVA customer result. Your own numbers depend on your leads, your script, and your market. Model them with your real figures on the brokers calculator.

Verify this yourself

Sources, labelled on the brokers page: AgentZap — Real Estate Lead Response Stats 2026; GreetNow — Lead Response Time Stats 2026. Same honest framing used there: industry benchmark, not a performance claim.

Seen the proof? Now look at your own numbers.

Book a 20-minute call with NOVA's founder about how your brokerage handles paid leads today. A human conversation — not the AI placing a call to you.

Book a 20-minute discovery call

Books a founder call, not an automated call. No demo mode flipped, no credit card.