Under Spain's Law 10/2021, regular remote work calls for a written agreement that lists the equipment and tools the employer provides. Yet in plenty of offices the technology is still whatever got cobbled together in March 2020: remote desktop forwarded straight through the broadband router, and one password known to three colleagues. It survives until an automated scanner stumbles on that port. Apply rebuilds access on different lines: nothing reachable from the open internet, data held in Microsoft 365 or on servers you control, and every leaver cut off the moment they go.
Scope follows the tools your people genuinely rely on. A sales team living in email and proposals has different needs from an accounts department tied to an a3ERP installation on the office server.
One route is a classic tunnel that places the laptop inside the corporate LAN; the other publishes each application separately under a Zero Trust approach. Whichever you choose, the connection is granted only to a managed, patched device tied to a live account, never to anybody who simply knows the password.
With Azure Virtual Desktop or an in-house session host, the working environment runs in the data centre while the laptop at home merely displays it. Files stay on the server even if the machine is left behind on an AVE high-speed train.
a3ERP, Sage 200, ContaSol or a heavyweight design package run smoothly in a remote session, because only the screen crosses the internet, not the database. Nobody needs to copy the accounts onto a USB stick to finish the month-end close at night.
Microsoft Authenticator supplies the second factor, and rules in Entra ID turn away sign-ins from countries where you employ nobody or from unrecognised devices. A password harvested by a phishing email no longer unlocks anything on its own.
Laptops and phones enrolled in Intune, drives encrypted with BitLocker, remote wipe available if one goes missing. Intune also produces the list of devices issued to each person, which is precisely the equipment inventory the remote work agreement needs. On a leaver's last day, one action disables the account, the tunnel and the mailbox together.
The employer agrees its disconnection policy with staff representatives; Apply translates it into the tools. That means quiet hours in Teams, scheduled sending in Outlook so a 22:00 email lands at 9:00, and single sign-on to Factorial, A3nom or whichever clock-in app you use, so that logging working hours from home is not one more chore.
Three typical set-ups. The decision rests on the kind of data involved and where your applications live, rather than on the number of home-working days per week.
Option 1
Company laptop plus VPN
Staff receive a corporate device and join the internal network over a VPN client.
Option 2
Virtual desktops or a session server
Applications and data remain in one place; only the picture reaches the employee's home.
Option 3
Everything in Microsoft 365
Email, documents and teamwork in the cloud, with no need ever to join the office network.
The most frequent weak spot is still remote desktop published to the internet as it stands. An open port 3389 shows up on automated scanners within hours, then come the bulk password attempts and, all too often, ransomware. It is no accident that INCIBE keeps stressing this in its guidance for businesses. If your staff connect this way from home, shut that door first, before any talk of virtual desktops or agreements.
Technically yes, by way of a hosted desktop or the web versions of Microsoft 365, with a conditional access rule that blocks file downloads so no document is saved to the private drive. Admitting a personal computer to the internal network through a VPN is a different story, as its contents are a mystery. Legally, Law 10/2021 makes the employer responsible for providing and maintaining equipment and bars it from requiring software to be installed on devices the worker owns. Confirm this point with your employment adviser.
The technical section. Apply draws up the inventory of equipment and tools with their expected service life, and sets out permitted connections, where files are stored, what to do if a laptop is lost and whom to notify. Expense compensation, the share of working time, occupational risk prevention and the disconnection policy are prepared by HR, your prevention service and the workers' legal representatives. Our text slots in without rewriting theirs.
If it talks over a basic VPN to a database back at the office, probably yes: client-server software handles latency poorly, and a dropout halfway through a write can corrupt the data. The proper answer is a remote session in which only the screen travels. The experience then comes very close to working at the office, even on the modest fibre of a shared flat.
Apply keeps connection logs recording who signed in, at what time and into which system, which is a reasonable security measure. What it does not deploy is tools that capture screenshots or log keystrokes. Spain's LOPDGDD contains specific articles on privacy when employees use digital devices at work, and the AEPD has set demanding criteria; this is a matter for your DPO or an employment lawyer. On a practical level, such monitoring erodes more trust than it creates.
Recording working hours is the employer's legal duty, and you choose the system together with your adviser. Apply makes sure it works properly at a distance: sign-in with the same Microsoft or Google account, the app pushed to phones and laptops, and permissions so each manager sees only their own team. If clocking in from home takes five clicks and yet another password, people simply forget.
Timing depends on the number of people, devices and applications; after a remote review we give you a realistic schedule. The work is billed at €75 per hour + VAT or folded into a monthly maintenance plan. Virtual desktops are quoted separately, since the bulk of the price is the compute capacity reserved for everyone who is connected at the same moment.
Tell us how many people work away from the office and which applications they cannot do without. We will suggest the model that best fits your data and your constraints.
Your request is with us
Expect an answer within one working day. A reported fault that has halted your team is handled first.
No match found. Try another spelling, or go with the closest provincial capital: every job is done remotely, so the location makes no difference to what we deliver anywhere in Spain.
