Under Slovenia's Employment Relationships Act (ZDR-1), working from home calls for a written arrangement between employer and employee, and anyone who uses their own equipment for the job is owed compensation for it. Health and safety and the protection of data remain the employer's responsibility. The paperwork is usually done. The technology is another story: many firms still rely on what was cobbled together in a hurry in spring 2020, typically a router port forwarded to a remote desktop and one password shared by three colleagues. It survives only until some bot sweeping the internet finds it. Apply redesigns access from the ground up: no service answers directly from the internet, data stays in Microsoft 365 or on your own servers, and a departing employee is locked out the instant they go.
Which pieces you need depends on the tools people use all day. Salespeople who live in their inbox and in quotes have very different needs from a finance team whose Pantheon database sits on a box in the office.
You can open an encrypted tunnel into the office network, or publish each application separately under a zero trust model. In both cases the gate opens only for a managed, patched device paired with a live account, never for whoever has got hold of a password.
With Azure Virtual Desktop or a terminal server, the Windows session lives in a data centre and the home laptop only shows the picture. Forget that laptop on the Ljubljana to Maribor train and you have lost a piece of hardware, not your files.
Pantheon, Birokrat, estimating and progress-billing software for builders, or a demanding Autodesk package behave well inside a hosted session, since what crosses the internet is pixels rather than database traffic. Month-end no longer tempts anyone to carry company data home on a memory stick.
Logins are confirmed in the Microsoft Authenticator app, and Entra ID policies refuse attempts from countries you do not operate in or from hardware nobody recognises. A password harvested by a fake login page is, by itself, worthless.
Every laptop and phone is enrolled in Intune, drives are BitLocker-encrypted, and a missing device can be erased from afar. As a by-product Intune lists which employee has which device, handy for the clause on work equipment in your written home working arrangement. Leavers lose their account, VPN and mailbox in a single action.
Management decides the policy; we wire it into the software. Teams goes quiet out of hours, Outlook holds late-night mail until morning (written at 23:00, delivered at 8:00), and the attendance app accepts the same Microsoft login through SSO. Recording your start and finish from home becomes a single tap.
Most firms land on one of these. The deciding factor is the sensitivity of your data and where your software runs, far more than the number of home days per week.
Option 1
Work laptop plus VPN
Staff get a company machine and join the office network over an encrypted link.
Option 2
Hosted desktop or terminal server
Programs and files never move; the home screen just mirrors the session.
Option 3
Cloud-only with Microsoft 365
Mail, files and teamwork all in the cloud, the office LAN never involved.
The weakness we meet most often is still a remote desktop server answering straight from the internet. Port 3389 left open gets picked up by scanners within hours; brute-force password attempts follow, and ransomware is a common finale. SI-CERT, Slovenia's national response team, keeps warning about exposed remote administration services as well. If that is how your people log in from home, close it before discussing anything else, hosted desktops and contract clauses included. In most cases it is a job of a few days using licences you already pay for.
It can be done safely through a hosted desktop, or through browser-based Microsoft 365 with a policy that forbids downloads, so company files never touch the private drive. Letting a home PC onto the office LAN via VPN is unwise, because its contents are a mystery. Legally, ZDR-1 foresees compensation when staff work with their own equipment, with the amount and method settled in the written arrangement. An employment lawyer or your accountant can confirm the detail.
On the IT annex. We list the hardware and software the employer supplies, the approved ways of connecting, where documents must be saved, the steps after a laptop is lost and who must be told. Compensation, the extent of home working, working-time rules and occupational safety belong to HR and your lawyer. Our text slots in as an attachment, so nobody has to redraft the main document.
It will if each home PC talks to the office database across a bare VPN. Client-server software hates latency, and a link that breaks while a posting is being saved can damage the data. A hosted session solves it: only screen updates travel, so even an ordinary domestic broadband line feels almost like sitting at your office desk.
We log connections, meaning who reached which system and at what time, as a normal security control. Screen recorders and keyloggers are something we will not deploy. Observing employees counts as processing personal data under GDPR and ZVOP-2, which brings in proportionality, purpose limitation and transparency, and Slovenia's Information Commissioner has published opinions on workplace monitoring. Take legal advice before going further. Experience says such surveillance damages trust far more than it helps.
Keeping attendance records is an employer obligation, and the choice of tool rests with you and payroll. Our part is making it painless off site: one login shared with Microsoft or Google, the app deployed to mobiles and laptops, and visibility set so every manager sees just their own people. A system that needs five clicks and a separate password is a system people skip.
Anywhere in Slovenia makes no technical difference: a managed laptop with MFA behaves the same in a Ljubljana flat and in a cottage on Pohorje. Abroad is different, as conditional access will block the login. Once a manager approves, we open a temporary exception for that individual and that country, which shuts itself on the end date. Tax, social insurance and the effect on the home working arrangement are questions for HR and your accountant.
Timing scales with headcount, device count and the number of applications involved. A remote assessment comes first, and you then receive a schedule we can stand behind. We charge €50 an hour plus VAT, or include the work in your monthly plan. Hosted desktops get their own estimate, because the biggest cost is the computing capacity sized to how many people are logged in at once.
Say how many people work away from the office and which applications they cannot do without. We will recommend the set-up that suits your data and the way you operate.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.
