(Bloomberg) -- Clubhouse has in just two months become the venue of choice for luminaries like Elon Musk or Drake to expound on everything from telepathic monkeys to stock market valuations. But the real winner of the audio-chat app’s stratospheric rise is a loss-making Shanghai startup called Agora Inc.Agora, known mostly within tech circles as an industrious but low-profile provider of software tools, has soared more than 150% since mid-January when online chatter began to circulate about how it powers the world’s hottest new social media forum. That’s because the little-known company -- now worth almost $10 billion -- provides developers with all they need to build real-time voice and video functions within applications: a template known as a software development kit.Agora -- ancient Greek for a forum or market -- has been linked publicly since its IPO last summer to Clubhouse, though it remains unclear the extent to which the red-hot social media forum employed its software kit. Decompiling the Clubhouse app reveals Agora’s name in the code, meaning Clubhouse is using at least part of the Chinese firm’s SDK, according to two engineers familiar with the matter, who asked not to be named because taking software code apart violates Apple’s iOS user policies.Clubhouse’s co-founders, Paul Davison and Rohan Seth, have said in conversations on the app that they use Agora, according to two people who heard those discussions but asked not to be named because Clubhouse doesn’t talk publicly about its tech stack. And in an experiment this week, German software engineer Andreas Lehr told Bloomberg News he analyzed traffic coming out of his phone while connected to Clubhouse and noticed several calls out to agora.io.Read more: Clubhouse Tops Japan Chart as CEOs, Celebrities Embrace AppBeyond just powering Agora’s stock price however, that amorphous link is beginning to spur concerns about the security of the app. It’s the same vague fear that attaches itself to the largest of companies from TikTok-owner ByteDance Ltd. to unheard-of outfits: that Beijing has the power to not just demand they hand over data at will, but also compel Chinese companies to spy on its behalf. Agora declined to comment on its relationship with Clubhouse but said in a statement it takes privacy and security seriously.“Just like in the case of Zoom, Agora still runs its centralized service in different jurisdictions,” said Suji Yan, the founder and chief executive officer of data privacy startup Mask Network, which builds a tool for users to post encrypted messages on Twitter and Facebook. “It’s hard for a public corporation like Agora not to respond to a local government’s request.”The debate around the extent of Agora’s involvement comes even as Beijing appears to move against Clubhouse. Many of the app’s users in China say they’ve been unable to access the service since Monday, after an explosion of discussions over the weekend on taboo topics from Taiwan to Xinjiang.Read more: Clubhouse Users in China Say Service Appears to Be BlockedBut it’s the potential for surveillance that worries international users. Chinese law requires its companies to hand over information on request and even gather data on behalf of Beijing, if it’s deemed in the interests of national security. That, along with accusations from U.S. lawmakers that Chinese firms can build backdoors into devices and software for the Communist Party can exploit, is at the heart of a growing hostility toward China’s largest tech providers.Agora’s own customizable tools run on users’ devices as part of client applications like Clubhouse. Agora co-founder Tony Wang has told media the company doesn’t store any end-user data but serves as a “pass-over.” But from a technical perspective, it does get ahold of real-time voice data that it helps transmit on Clubhouse. It won’t be able to cross-identify that with users’ mobile numbers -- which in turn unearths their real-world identities -- because such data is managed by Clubhouse itself, according to the two engineers familiar with the
matter.In theory, Chinese operatives can cross-check Agora’s voice data against other voice data that does link up with real IDs -- for example, those from state-owned Chinese telecom operators -- as a way to identify activists or dissidents, said Mask Network’s Yan.“Right now I don’t think the government would have the computing power to do so, but you can’t rule out that possibility for the future,” Yan said. “And the cross-reference of voice data bound to the same cell number will leak more data and cause more potential problems than we thought.”Started in 2013 by software engineer Tony Zhao, Agora has grown to become one of China’s largest providers of real-time communications technology, powering big names like teaching services provider New Oriental Education & Technology Group and dating app operator The Meeting Group. It’s attracted investment from venture capital firms including SIG, Coatue Management and China’s Morningside, which is also one of the earliest backers of short-video app Kuaishou Technology.Revenue grew 81% to $30.8 million for the September quarter, when companies outside China contributed more than 20% of sales, executives told analysts during a post-earnings call in November.Agora itself highlighted China’s complex internet regulatory regime as a risk factor in its IPO prospectus, adding it may be required to take further steps to comply with the European Union’s GDPR privacy laws or regulations elsewhere. It currently offer products in more than 100 countries.Still, speculation about Clubhouse’s Chinese roots hasn’t hurt its global popularity for now, nor has Beijing’s actions.“The Chinese-language discussions I heard over the last week were remarkable in that they touched on issues that are heavily censored in China, while allowing open discussion across the Chinese border,” said Graham Webster of the Stanford University Cyber Policy Center.Read more: Clubhouse App Offers Chinese Rare Glimpse of Censor-Free Debate(Updates with Agora’s statement in the fifth paragraph)For more articles like this, please visit us at bloomberg.comSubscribe now to stay ahead with the most trusted business news source.©2021 Bloomberg L.P.