The full company page is on the main site: What Is Jobbit? Inside the UK AI Agent and Human Network. What follows is the short version, with the security lens on.

Jobbit in sixty seconds

Jobbit is a UK company with three connected divisions.

• Jobbit.uk is an AI agent and human network. You describe a job in plain language and the agent builds the web app, runs the automation, writes the document, does the research or makes the media. When a task needs a person, it hands the job to a vetted expert on Jobbit Pro, with payment held in escrow until the work is accepted. The company's guide to the 12 jobs an AI agent can do for a business this week is the practical tour.
• Jobbit Labs is the research division. It records, with consent, how real-world work is done on the platform and builds datasets, evaluations and world models on that data for AI and robotics teams.
• Jobbit Security, this site, is the offensive security practice: manual penetration testing, cloud security assessment, red team operations, phishing simulation and vCISO support for UK businesses, aligned to OWASP, NIST SP 800-115, PTES and MITRE ATT&CK.

One company, one team in London, one loop: work is assigned and executed on jobbit.uk, what it teaches goes to Labs, and Security keeps the whole system tested.

Why an AI company runs its own red team

Two reasons, and both are worth understanding before you trust any agent vendor.

First, the agent platform and the data engine handle customers' code, files and operations. A company in that position should be tested by people who are trying to break it, and we would rather that team was ours than someone else's. Jobbit's stated principle is "test yourself first": offensive security runs on our own systems before it is sold to anyone.

Second, the same AI that lets a business build an app in an afternoon lets an attacker find that app's weaknesses in an hour. Attack tooling has become faster and cheaper at exactly the moment more small businesses are shipping software they did not write by hand. A company that builds with AI should be able to defend with it, and that expertise has to live somewhere. It lives here.

Five questions to ask any agent platform

Vendors will answer the questions you ask. These are the ones worth asking, with what Jobbit says about each, so you can hold us to the same standard.

1. Where does the work run, and who hosts what it produces?

An agent that builds a website or an automation has to run it somewhere. Ask whether the output lives on the vendor's infrastructure, yours, or a third party's, and how you would move it. Jobbit builds and hosts web apps on its own hosting, keeps task runs and files in your workspace, and states plainly that the files, the code and the exports are yours to take with you.

2. What is retained, and what is used for training?

This is the question most often skipped. Ask what the platform keeps after a task ends, whether it is used to train models, and whether you can opt out. Jobbit's answer is that records of how tasks are done are captured inside the platform with the customer's consent and with clean provenance, nothing is scraped, and the same records feed Jobbit Labs only on that basis.

3. If humans are involved, how are they vetted and paid?

An agent that hands work to people has just widened your supply chain. Ask who those people are, how they are vetted, what they see, and what protects payment. On Jobbit, experts come from the vetted Jobbit Pro network, the agent drafts a scoped brief, and payment sits in escrow until the work is accepted, so both sides have a record and a remedy.

4. What can the agent reach, and how is that scoped?

Agents are useful because they act. That is also the risk. Ask how credentials are stored, whether the agent can browse or log in to accounts, and how you limit what a single task can touch. Jobbit's Projects feature keeps shared files, instructions and secrets together per project, and its agent browser lets you take control and hand back mid-run. Whatever platform you choose, give it its own least-privilege accounts rather than your own.

5. How do you get everything out?

The exit is part of the entrance. Ask whether exports are complete and in open formats, and whether hosting can be moved. Jobbit's pricing pages and its company post commit to no lock-in: free means free, no watermark, and your work leaves with you. Test that promise with a small project before you rely on it.

A safe first month with an agent

Whichever platform you pick, the same habits keep the blast radius small while the business learns what the agent is good at.

• Start with tasks that need no access. Documents, research, images and the free online tools prove the workflow without touching a single account. Our companion post on free online tools and client data covers the file-handling side.
• Create separate credentials. A dedicated mailbox, API keys with the minimum scopes, and a separate card if the agent will ever buy anything.
• Review automations before they run on a schedule. Read what a scheduled task does, and who it emails, before it does it every Monday.
• Keep a human approval step for money and outbound messages. Drafting is cheap; sending is not reversible.
• Read the run log. Jobbit keeps task runs in the workspace. Ten minutes a week reading what the agent actually did teaches you more than any policy document.
• Rotate anything you pasted into a chat by mistake. Treat a secret in a prompt like a secret in a ticket.

None of this is specific to Jobbit. It is what we would tell a client about any agent, and what we check when we test one.

Where Jobbit Security fits

When a business has moved past the first month and the agent is building real things, the question changes from "can we trust it?" to "can we prove it?". That is a penetration test: manual, depth-first testing of the web apps, APIs, cloud accounts and automations the business now depends on, including the ones an agent built. We test the full attack surface, work under NDA at a fixed scope and price, and write the report for the people who have to fix things and for the board that has to sign off the budget.

If that is where you are, book a scoping call. A consultant replies within one working day.

This is the checklist we give clients when we review how a business handles its everyday documents. It is short, it is practical, and it ends with how the free tools on jobbit.uk handle the same jobs, because Jobbit Security is part of the company that built them and we would rather explain the trade-offs than pretend there are none.

The four risks hiding in "free"

Uploads leave your machine. The moment you drop a PDF on a compressor's website, the file is on someone else's server. Some tools delete it within the hour. Some keep it to train models or to serve advertising. Many say nothing at all. A tool that is free and has no visible business model is being paid for somehow, and the file is often the currency.

QR codes can point anywhere. A printed code is a link you cannot read. Dynamic codes, the kind most free generators default to, route through the provider's server first, which means the destination can change or expire without the code changing. Attackers exploit the same blindness by sticking their own codes over legitimate ones on parking meters, menus and posters, a technique called quishing.

Images carry more than pixels. A photo from a phone usually contains EXIF metadata: the time, the device, and often the GPS coordinates of where it was taken. Resize a photo of your home office for a listing and a careless tool will publish your home address in the file.

Invoices are an attack surface. Invoice fraud, often called mandate fraud, is one of the most common ways UK businesses lose money: a criminal impersonates a supplier and asks for the bank details on file to be changed. Editable invoice files, inconsistent numbering and templates reused across clients all make the impersonation easier and harder to spot.

Checklist: compressing and sharing PDFs

• Read the retention line before you upload. If you cannot find it in thirty seconds, assume the file is kept.
• Sort documents into three bins: public, internal, and regulated or privileged. Only the first bin goes to an anonymous free tool.
• Prefer tools that work inside an account you control, so there is a record of what was uploaded and by whom.
• Check the output. Aggressive compression can turn a signature or a small-print clause into an unreadable smudge, which is its own problem when the document is a contract.
• Compress once, at the end. Repeated compression compounds the damage.

The jobbit.uk guide to compressing a PDF for free with no upload limit covers the size-versus-legibility trade-off in detail.

Checklist: QR codes on anything you print

• Use static codes for print. A static code encodes the final address, so nothing can be changed after the poster goes up and nothing expires when a subscription lapses.
• Point codes at a domain you own, never at a shortener you do not control.
• Keep a register of every code you have printed, where it is, and what it points to.
• Scan your own codes in the wild every few months. If the destination is not yours, someone has covered it.
• Tell staff that a code on a poster, a parking meter or an email attachment is a link from a stranger, and to treat it that way.

The free QR code guide on jobbit.uk explains why most free codes stop working and how to make one that does not.

Checklist: resizing and publishing images

• Strip metadata on export. Check the output file's properties before it goes on a listing, a job advert or social media.
• Be deliberate about what is in the frame: screens, whiteboards, paperwork and door numbers all leak.
• Keep originals in a controlled folder, and publish only the resized copies.
• For staff photos, get consent for the specific use, not a blanket one.

Formats and platform sizes are covered in the image resizing guide.

Checklist: invoices that cannot be tampered with

• Send PDFs, not editable documents, and never a template with other clients' details left in.
• Number invoices sequentially and state your bank details the same way every time, so a change stands out.
• Put a line on every invoice saying that you will never change bank details by email, and ask customers to phone a known number if they receive such a request.
• Do the same in reverse: verify any supplier's change of details by calling a number you already hold, not one in the message.
• State payment terms and statutory late-payment interest clearly. An invoice that reads like it was produced by a process is harder to impersonate than one that reads like a favour.

The invoice guide on jobbit.uk lists the nine fields a UK invoice needs and the late-payment terms that get it paid.

How Jobbit's free tools handle the same jobs

Jobbit's four tools, a QR code generator, a PDF compressor, an image resizer and an invoice generator, are forms that send a single message to the Jobbit agent, which does the job inside your own workspace and hands the file back. The overview post, four free online tools on jobbit.uk, links all of them.

Against the checklist above, this is what you get and what you should still do:

• Account, not anonymity. The tools run on the free plan with no card, but inside an account, so there is a record of what was done. Jobbit's stated principle is that your files, code and exports are yours to take with you.
• Consent for training. Records of how tasks are done are used to improve the agent only with consent and clean provenance. Nothing is scraped. Read the terms before you rely on that for regulated material, as you would with any provider.
• Static QR codes. The QR tool makes static codes that encode the final address and never expire, in PNG and SVG, which is the right default for print.
• Sensible defaults for the rest. PDFs to a target size with legible text, images to exact platform dimensions, invoices with the nine UK fields and payment terms. Check the output as you would from any tool.

We say all of this as the team that tests Jobbit's own systems. The company's principle is "test yourself first", and the reasons it runs an in-house red team are set out in our post on what Jobbit is, from a security lead's point of view.

When a free tool is the wrong answer

Some material should never go through a shared online service of any kind: health records, legally privileged documents, payroll files, anything covered by a client's own security schedule. For those, use tooling that runs on your own machines or under a contract that names retention, location and deletion. And if a business is handling client files at volume, the question is no longer which free tool to use but whether the process around them has ever been tested.

That is what we do. If you would like a second pair of eyes on how your business handles documents, uploads and payments, book a scoping call. No obligation, and a consultant replies within one working day.