French labour law gives telework its own provisions, and a company introduces it through a collective agreement or a charter. The technical half is often stuck where the lockdown years left it: a desktop port forwarded on the office router, one shared credential circulating among three colleagues. That arrangement survives precisely until an automated scanner wanders past the address. We rebuild the route in: nothing published to the open internet, records that stay inside the cloud tenancy or on your own hosts, and a leaver whose access ends the afternoon they leave.
The shape of the answer follows what your colleagues genuinely spend the day in. A sales function living in mail and proposals asks for something quite unlike a finance function tied to a package installed on a host at the head office.
One option encrypts a path into the company network; the other hands out access one application at a time and trusts nothing by default. Either way, the connection is granted to a managed, patched device tied to a live account, rather than to whoever happens to know a password.
Azure Virtual Desktop, or a session host of your own: the working environment executes centrally and the machine on the kitchen table receives a picture of it. Documents never leave the host, so a laptop left on a train costs you the laptop and nothing else.
Sage, Cegid, Divalto or a demanding design package behave comfortably inside a published session, because what crosses the line is a rendered screen rather than a database. No colleague ends up copying a ledger onto a personal drive to finish something in the evening.
An authenticator application on the phone, plus directory rules that decline sign-ins from countries where you employ nobody and from devices the estate has never seen. A credential harvested in a convincing phishing message then unlocks precisely nothing on its own.
Laptops and handsets enrolled in Intune, drives encrypted, a remote wipe available when one goes missing. The day an employment contract ends, the account, the tunnel and the mailbox shut together, and nobody spends a week hunting for forgotten access.
A telework agreement or charter also governs equipment and the handling of records. We draft that section: which devices qualify, what sort of connection, where documents are allowed to live, what somebody does within the hour of losing a laptop. Working time, allowances and the right to disconnect belong to your HR function and your staff representatives.
Three configurations come up repeatedly. What decides between them is the sensitivity of the records involved and where your applications physically execute, rather than the number of days spent away from a desk.
Setup 1
Company laptop, encrypted tunnel
Everyone receives a machine belonging to the firm and dials into the internal network over it.
Setup 2
Hosted desktops or a session host
Applications and records execute centrally; only a rendered screen reaches the home.
Setup 3
Everything inside Microsoft 365
Mail, documents and collaboration in the cloud, with the office network never entering the picture.
The weakness we meet most often is a desktop service exposed directly on a public address. Automated scanners find an open 3389 within hours, credential guessing follows, and extortion software arrives behind it often enough to be predictable. Where colleagues currently connect from home that way, closing it comes before any discussion of hosted desktops, charters or budgets.
Technically it can be arranged, through a hosted desktop or the browser versions of the cloud suite, with a rule that refuses downloads so that nothing settles on a private drive. Admitting a personal machine to the internal network over a tunnel is a different proposition, since nobody can vouch for what is installed on it. Legally, French labour law places the supply and upkeep of work equipment on the employer, and relying on personal hardware requires an explicit arrangement; have that confirmed by your HR function or your legal adviser.
To the technical clauses, willingly. We set out which equipment and which connections qualify, how records about people are protected, the steps taken after a laptop disappears and who has to be told. Allowances, occupational risk assessment, prevention duties and disconnection rules are produced by your HR function, your prevention service and your employee representatives. Our clauses then drop in without disturbing theirs.
Across a plain tunnel to a database that stayed behind in the office, very probably. Applications of that generation tolerate delay badly, and a connection failing during a write can leave the database needing repair. The dependable answer is a published session, where a rendered screen is all that crosses the line. Comfort then sits close to working at a desk in the building, even on an unremarkable domestic connection.
Authentication records, showing which account reached which system and when, are a normal security measure and we maintain them. Software that captures screens or keystrokes is something we decline to install. Surveillance of that sort runs into real difficulty under the GDPR, French employment case law and the guidance issued by the CNIL, so examine it with your legal adviser or your data protection officer. On the evidence we have seen, it also corrodes trust faster than it ever returns anything.
Timing follows the number of colleagues, devices and applications in scope, so a credible schedule comes after the survey rather than before it. Build work is charged at EUR 95 an hour before VAT, or folded into a monthly agreement. Hosted desktops are quoted on their own, because the dominant cost is the capacity reserved for however many people are signed in simultaneously.
Tell us how many colleagues work away from the office and which applications they cannot manage without. We come back with the approach that suits your records and your constraints.
Message received
An answer follows inside one working day. Report an outage that is stopping people working and it moves ahead of everything else.
Nothing here under that name. Check the spelling, or simply choose the nearest large city instead. Since every engagement runs remotely, whichever you pick changes nothing about what we do for you.
