Recently, when a woman went to the Supreme Court asking for her blocked WhatsApp account to be restored, the judges had an unexpected suggestion: “Use Arattai”. The comment, made while dismissing her plea, may have been offhand, but it summed up a bigger mood. India’s push for “digital sovereignty” has created a wave of support for homegrown apps, with policymakers and tech voices calling for Indian alternatives to foreign platforms.
Zoho’s Arattai—which means “chat” in Tamil—has quickly found itself at the centre of that wave. Once a low-key product, it’s now being seen as the “swadeshi WhatsApp”. The app’s daily sign-ups jumped from about 3,000 to 3,50,000 within days, and by early October, it had crossed 7.5 million downloads on Google Play and the App Store.
This high-visibility has drawn attention not just to Arattai’s features or security claims, but to a curious detail: its developer listings on Google Play and Apple’s App Store point to a US address: 4900 Hopyard Rd, Suite 310, Pleasanton, California 94588, United States. Zoho’s founder Sridhar Vembu addressed the issue on X, saying the US address reflects how the developer accounts were registered early, rather than indicating where infrastructure or data is based.
However, this juxtaposition—a “Made in India” narrative with a US address hanging in public view—opens a rich terrain of questions: national identity, regulatory jurisdiction, trust, and technical stealth.
What We Know About Arattai
Arattai is the messaging product of Zoho Corporation, a Chennai-based software company co-founded by Sridhar Vembu. The app was quietly incubated and first soft-launched around 2021, but only recently did it break out into the public eye in a big way.
Its appeal, especially in the early surge, is tied to two intertwined narratives. First, Arattai positions itself as fundamentally Indian: engineered, maintained, and grown by Zoho’s local teams. Second, it leans hard into accessibility. Vembu and others have made public statements that the app is optimised to run reliably on low-end phones and under low bandwidth conditions —a design decision intended to broaden reach beyond urban elites.
In functionality, Arattai aims to replicate the everyday essentials: text chat, voice/video calls, stickers and media sharing, groups, stories, channels/broadcasts—even a desktop/TV version. On the privacy front, its public posture is more cautious: calls are end-to-end encrypted (E2EE), and some “secret chat” or personal chat modes are being introduced, but full message encryption for all chats is not yet default. Zoho has publicly committed to rolling out full E2EE soon.
Where does the data live? Zoho asserts that Indian user data is hosted entirely in India (Mumbai, Delhi, Chennai, soon Odisha), and that Arattai uses its own infrastructure rather than major cloud providers for core storage. Some cloud services may be used for “switching nodes” or regional performance optimisation, but the claim is that data is never stored in AWS, Azure, or Google Cloud.
But that’s the public claim. The US address on the app store listings—as Vembu candidly explained—comes from legacy setups: the developer accounts were registered early (during testing phases) under US address details, and have not yet been updated.
Jurisdictional Gray Zones: What A US Address Really Means
Arattai’s US address might look like a small detail, but it carries big legal implications. Cyberlaw expert Advocate Prashant Mali says that listing a US address creates a “juridical nexus” —a legal connection—to the United States. “It makes the app appear to operate in the US market, even if all operations are in India,” he explained.
That link can bring the app under US consumer protection, privacy, and export laws. Mali noted the app could be subject to Federal Trade Commission (FTC), which monitors misleading claims and user privacy violations, or to the Office of Foreign Assets Control (OFAC), the US agency that enforces economic sanctions. “If the app targets US users or its data suggests a US presence, regulators can demand disclosures or investigate it,” he said.
He added that the address also triggers potential tax obligations. “A listed US address can trigger tax obligations under the U.S. Internal Revenue Service (IRS) and make the app answerable to American consumer laws, especially if it earns revenue or attracts users from the US,” Mali explained.
Apple and Google, which host the app, also retain broad contractual power. “They can suspend, block, or remove apps for national security concerns, sanctions compliance or policy violations,” the advocate said. Geopolitical tensions, he warned, can make this risk more real. And if the US address isn’t a genuine office, it could be considered false representation, giving Apple or Google grounds to terminate accounts or seize earnings.
Therefore, what seems like a simple address line can create legal, tax, and geopolitical exposure, tying an Indian-built app to US laws and platform controls.
Who Can Access Your Data?
Beyond legal exposure, Arattai’s U.S. listing raises a simple but urgent question: who can compel access to user data? Security researcher Botsa Jaswanth warns that, because the app declares a U.S. address, “the app and its data are in compliance with US data and law-enforcement rules”. In practice, that means American authorities can request or demand user information—even if those users are in India.
“If the app doesn’t obey such requests from US authorities,” Jaswanth warned, “the US has the ability to pull it out of the Play Store or App Store.” That is, the app could be removed overnight, disrupting millions of users.
He also flagged a practical problem with Arattai’s global sign-up model, which allows registrations from anywhere: “Doesn’t that mean they store those users’ data within Indian servers?” he asked, noting that the answer has direct consequences for compliance with cross-border data laws.
Arattai user interface (Courtesy: X)
Is Arattai safe?
Vembu, Arattai’s founder, has said that while voice and video calls are already end-to-end encrypted, encryption for text chats is still being tested internally and will be rolled out in the coming weeks—earlier than the initially planned mid-November 2025 launch.
Jaswanth said the technical answer to, 'if Arattai is safe?', should start with encryption. He argued that end‑to‑end encryption must be the default, and that Arattai should publish its encryption protocol as a white paper—the transparency standard set by apps like WhatsApp and Telegram. “Without end‑to‑end encryption,” he warned, “chats, media, and device information may reside as plain text within databases, and if a breach happens, every piece of user data could be at risk.”
He added that protection must cover data at rest (on servers), data in transit (while moving between devices and servers), and the metadata that accompanies messages.
Arattai’s rapid rise comes with a degree of uncertainty. Not necessarily a security flaw, but a reminder of the complex terrain homegrown apps must navigate: balancing fast adoption, a “swadeshi” identity, and compliance with international data standards.
