Clubhouse has in just two months become the venue of choice for luminaries like Elon Musk or Drake to expound on everything from telepathic monkeys to stock market valuations. But the real winner of the audio-chat app’s stratospheric rise is a loss-making Shanghai startup called Agora Inc.

Agora, known mostly within tech circles as an industrious but low-profile provider of software tools, has soared more than 150% since mid-January when online chatter began to circulate about how it powers the world’s hottest new social media forum. That’s because the little-known company — now worth almost $10 billion — provides developers with all they need to build real-time voice and video functions within applications: a template known as a software development kit.

Agora — ancient Greek for a forum or market — has been linked publicly since its IPO last summer to Clubhouse, though it remains unclear the extent to which the red-hot social media forum employed its software kit. Decompiling the Clubhouse app reveals Agora’s name in the code, meaning Clubhouse is using at least part of the Chinese firm’s SDK, according to two engineers familiar with the matter, who asked not to be named because taking software code apart violates Apple’s iOS user policies.

Clubhouse’s co-founders, Paul Davison and Rohan Seth, have said in conversations on the app that they use Agora, according to two people who heard those discussions but asked not to be named because Clubhouse doesn’t talk publicly about its tech stack. And in an experiment this week, German software engineer Andreas Lehr told Bloomberg News he analyzed traffic coming out of his phone while connected to Clubhouse and noticed several calls out to agora.io.

Beyond just powering Agora’s stock price however, that amorphous link is beginning to spur concerns about the security of the app. It’s the same vague fear that attaches itself to the largest of companies from TikTok-owner ByteDance Ltd. to unheard-of outfits: that Beijing has the power to not just demand they hand over data at will, but also compel Chinese companies to spy on its behalf. Agora declined to comment on its relationship with Clubhouse but said in a statement it takes privacy and security seriously.

“Just like in the case of Zoom, Agora still runs its centralized service in different jurisdictions,” said Suji Yan, the founder and chief executive officer of data privacy startup Mask Network, which builds a tool for users to post encrypted messages on Twitter and Facebook. “It’s hard for a public corporation like Agora not to respond to a local government’s request.”