Businesses Private clients
Get remote help Help
How companies settle invoices SWIFT bank transfer or card Checking that an invoice really came from Apply PDF invoices and related paperwork
Slovenščina English
Send an enquiry
Services
Solutions
Pricing
Courses
Articles
About Apply
Contact
Send an enquiry
Browse the catalogue: 80 services in 18 areas
Managed IT support Hand routine IT chores to a remote team and keep your people focused on clients End-to-end IT support One contract and one predictable bill for laptops, servers and Microsoft 365 IT helpdesk Stuck colleagues reach a technician in minutes, not the next morning Service desk Tracked tickets with clear owners, deadlines and a monthly recap 24/7 support Overnight and weekend cover for businesses where downtime is not an option Plans: Start, Business, Premium Prices start at €450 monthly plus VAT, response targets fixed by contract
Service plans and SLAs Pick a 4-hour, 1-hour or 15-minute response and get monthly proof we hit it System administration Patching, identities and servers handled to a timetable, fully documented IT infrastructure Find out what is really holding you back before spending on new hardware Network and telephony Network audits, continuous monitoring and phone calls moved onto Teams Cloud and hostingNew Virtual, dedicated and storage capacity in EU data centres such as Hetzner or OVHcloud Backup and recovery Immutable copies beyond the reach of ransomware, with restore drills on the calendar
GDPR and data protection The paperwork a Slovenian controller needs, from processing records to processor contracts Security policies and documentation Short, readable rules your staff sign and genuinely stick to Security tooling roll-out Selection, deployment and tuning of EDR, mail filters and MFA Infrastructure security Visitors on guest Wi-Fi kept well apart from the finance server Application security Catch weaknesses in in-house code before release day Data leak prevention (DLP) Payroll spreadsheets and client databases stay where they belong Database security Every query against sensitive tables leaves a trace Web application firewall (WAF) Bots and SQL injection filtered out before they touch your checkout Access control and endpoint security Remote lock for mislaid laptops and MFA on every account VPN and encryption Secure connections to company systems whether at home, in a hotel or on a construction site Vulnerability scanning See your exposed weak spots first, ahead of any intruder Antivirus and EDR Behavioural detection catches what signature scanning misses SOC monitoring Round-the-clock log review, with action taken on genuine threats System hardening Unneeded ports and services closed on every Windows and Linux host Safe use of AI Agreed ground rules before client data ends up in ChatGPT or similar tools
Websites and web applications Brochure sites, shops, portals, SEO and upkeep: fourteen services in one area E-commerce and integrations Shop, Amazon, Minimax, Stripe and GLS working from shared stock and order data Custom software Move workflows out of spreadsheets into an application built for them Software testing and QA Bugs caught in testing, not by your buyers
Artificial intelligenceNew Practical AI projects aimed at a measurable business need Data and analytics A single warehouse and consistent figures instead of spreadsheet sprawl IT consulting and audit Impartial advice before you commit budget to a major IT project Digital marketing Find out which campaigns actually pay off
Software and licensing Genuine licences for dev and IT teams, with renewals tracked for you Training Live courses over video, from Microsoft 365 essentials to spotting phishing
Unsure what to tackle first? A brief remote check-up ends with a written list of five priorities Request a review
See all 13 solutions together
NIS2 readiness Risk assessment, incident planning and supplier security for NIS2 and ZInfV-1 GDPR compliance Processing records through to a breach procedure, delivered as a set Remote and hybrid work Protected access and managed laptops for staff outside the office Business continuity A rehearsed plan for the day a key server goes down
Retail and e-commerce Web shop, marketplaces, payments and couriers connected end to end Manufacturing ERP and plant network kept running across every shift Clinics and healthcare Stronger safeguards around patient records in surgeries and private practices Construction Office and site crews working from one current set of drawings Logistics and transport WMS, e-CMR and vehicle tracking available whenever the trucks roll
Small businesses Simple IT at a known monthly price for teams of five to twenty Mid-sized companies Support under an SLA plus regular security work as headcount grows Large enterprises Extra hands and niche expertise to back up your internal IT department Multi-site companies Headquarters and every branch in Slovenia on one IT standard
No match for your situation? Tell us about the company in a couple of lines and we will suggest the right services Ask for advice
Who we are The people behind Apply and why we work only remotely Articles Practical pieces about IT and security Paying us Invoices, SWIFT transfers or payment by card Contact Write via the form or by email, or book a video call
Service · Software testing and QA

Penetration testing

Think of a law firm in Nova Gorica running a client portal. Clients upload papers, track their cases and fetch draft agreements. The portal has been extended year after year by a series of developers. Each client is meant to see only their own files, by design at least. Now suppose a client edits the document ID in the URL, adds one, and opens another client's agreement. For a practice entrusted with confidential material, that would be a grave incident with GDPR implications as well. Broken access control is one of the most widespread and harmful categories of flaw, and automated scanners are poor at spotting it: they cannot know that client A has no business reading client B's papers. Penetration testing studies your application through an attacker's eyes, mostly by hand, with signed permission from whoever owns the system. Every weakness is recorded with proof, and once fixed it is retested so you know it is genuinely shut.

Ask about this service See the scope
Signed permission
from the owner, up front
OWASP
WSTG, ASVS and MASVS as the basis
Hands-on
catches logic and access flaws
Verification
proves each fix works

Scope of the service

No two scopes are alike. For a typical web application these are the areas that absorb most of the effort.

Check the scope with an engineer

Access matrix

We draw up which records and actions every role may reach, then attempt each combination. The lines between client, lawyer, assistant and admin accounts are where leaks usually happen.

Taking over accounts

Is there a cap on login attempts? Can a one-time code be predicted or bypassed? Can a reset link be steered to a different account? Is the session truly invalidated on sign-out?

Bending the business logic

Changing a price in the browser, redeeming a single-use code repeatedly, booking an occupied slot: not bugs in a narrow sense, yet damaging to you.

Input and uploads

SQL and OS command injection, XSS, hostile files dropped into attachment fields and hand-edited request parameters.

APIs and mobile apps

Does the API behind the app check authorisation on each call, throttle abuse, and avoid leaving keys or personal data unencrypted on the handset?

What the internet can see

Old subdomains, admin and database consoles left open, world-readable cloud storage and components several versions behind.

Report in two layers

A non-technical summary for the board, and for developers a CVSS rating, exact reproduction steps and remediation advice per finding.

How the work runs

Test window, contacts and the IP addresses we will use are fixed in writing beforehand, so your staff can tell testing from a real incident.

01

Scoping call

Roles, sensitive data, hosting arrangements and a convenient period for testing.

02

Permission

Signed consent from the system owner and, if relevant, the host, stating scope and dates.

03

Testing period

Largely manual work in Burp Suite and similar tools. Anything critical is reported to you immediately, not saved for the write-up.

04

Results and verification

An encrypted report, a video session with your developers and a re-check after remediation.

Leave room for remediation; do not test on the eve of launch. Testing two days before release turns a critical finding into a dilemma: postpone, or ship with a known hole. Book the test so that several weeks remain for fixing and re-checking.

Your questions answered

Accessing another party's information system without authorisation can be a criminal offence, whatever the motive. The real owner of the system has to grant it. Where a host or outside contractor runs the application, we get their sign-off as well.

For grey-box work: a test login per role, API docs if they exist, and the URLs in scope. Your passwords and genuine client data are not needed.

The detailed version is effectively a burglar's plan, so keep it to a few people. For third parties we write a brief statement covering scope, dates and the retest result.

Yearly as a minimum, and after any major change such as a new payment or sign-in method, a new API or a move to new infrastructure. If you fall under NIS2 and ZInfV-1, periodic testing can form part of your risk measures.

Scanning finds known issues and weak configuration quickly and should continue. It cannot grasp that one client must never read another's documents. Access and logic flaws need a human who understands the system.

More services in this area

Open the area page
Service Functional testing Before you sign off new software, an outside tester confirms it follows your business rules Service Load and stress testing Find out what peak traffic your system survives, while there is still time to act Service Test automation Scripts that report within minutes of each change whether something has broken Service Usability and UX testing Watch real people use your site or app and see exactly where they stall and quit

Get there before the attackers

Tell us the purpose of the application, its roles, the sensitive data it holds and who owns it. We will suggest a scope and timing.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.