njokey
Resources

Remote work compliance, in plain English

Short primers on the concepts behind this site — written to be useful whether or not you ever buy anything from us. Informational only; not legal or tax advice.

The library
Format
6 plain-English primers
Length
3–5 minutes each
Topics
PE · tax · verification · GDPR · payroll · policy
Audience
Anyone weighing remote-work compliance
Note
Informational — not legal advice
4 min

What is permanent establishment?

Permanent establishment (PE) is the point at which a company's activity in a country becomes taxable there — even without an office. For remote work, the trigger is usually a person: one employee, working from the wrong place, long enough.

Read
4 min

Remote work tax risks, explained

Tax exposure from remote work comes in layers: the company's (permanent establishment, payroll withholding) and the employee's (personal tax residency). Each layer has its own clock, and they all run on the same unnoticed days abroad.

Read
3 min

What counts as employee location verification?

Not all 'location data' is verification. An office address in the HR system is a declaration. An IP lookup is a guess. Verification means independently confirming where work happened, at the moment it happened, in a way you can later prove.

Read
4 min

GDPR and remote workers

Location is personal data, and employee location is sensitive in practice: the power imbalance of employment makes regulators sceptical of 'consent' and hostile to continuous tracking. That doesn't make verification illegal — it makes proportionality the design requirement.

Read
3 min

Cross-border payroll compliance

Payroll assumes a jurisdiction: tax tables, social contributions, benefits and insurance are all priced to a place. When the place silently changes, every downstream calculation is quietly wrong — and the employer usually carries the liability.

Read
5 min

How to build a remote work location policy

A good policy answers four questions in writing: where may people work, for how long, who approves exceptions, and how the company will know. Most policies stop after question two — which is why most policies are fiction.

Read
01Primer · 4 min read

What is permanent establishment?

Permanent establishment (PE) is the point at which a company's activity in a country becomes taxable there — even without an office. For remote work, the trigger is usually a person: one employee, working from the wrong place, long enough.

See the enforcement cases and thresholds

Why remote work changed the math

PE rules were written for branches and factories. Tax authorities now apply them to laptops: an employee closing deals or exercising authority from a country can create a 'fixed place of business' — their kitchen table. Most treaties use day-count thresholds (commonly 183 days per year; as low as 60 for senior staff in some jurisdictions, and any fixed place of business in others), and the days count whether or not the company knew about them.

What it costs when triggered

A triggered PE means corporate registration, back taxes on attributed profits, penalties and interest, plus professional fees to untangle it. Documented settlements run from tens of thousands to — in landmark cases — nine figures. The company usually learns about the exposure during an audit, years after the days were worked.

What good management looks like

You cannot manage a day count you cannot see. Companies that handle PE well keep a verified, per-jurisdiction count of where each employee actually works, alert well before thresholds, and hold evidence that stands up when a tax authority asks. That is precisely the record Njokey produces.

02Primer · 4 min read

Remote work tax risks, explained

Tax exposure from remote work comes in layers: the company's (permanent establishment, payroll withholding) and the employee's (personal tax residency). Each layer has its own clock, and they all run on the same unnoticed days abroad.

The full obligation map

The three clocks

Corporate PE thresholds, employer withholding obligations (which can start on day one in some US states and countries), and personal residency tests (typically 183 days) all count days independently. An employee 'working from the beach' for a quarter can start all three without filing a single form.

Why the honor system fails

Surveys are consistent: roughly two-thirds of employees don't report all days worked outside their home country, and the share of HR leaders confident they know where people work fell from 60% to 46% in a single year. Self-declaration is not a control — it's a hope.

The defensible position

Regulators respond to evidence of a working control: a policy, verification against it, alerts, and a signed history. Even where exposure occurs, demonstrating that you tracked and acted on location data materially changes the conversation.

03Primer · 3 min read

What counts as employee location verification?

Not all 'location data' is verification. An office address in the HR system is a declaration. An IP lookup is a guess. Verification means independently confirming where work happened, at the moment it happened, in a way you can later prove.

Multi-signal verification without hardware

The spectrum

Self-declaration (weakest — trusts the employee's form), IP geolocation (defeated by any consumer VPN), single-signal GPS (spoofable, and usually collected covertly), multi-signal verification (IP, GPS, device fingerprint, network trust and travel plausibility cross-checked — hard to fake, cheap to run), and hardware-bound verification (a physical key binds the machine to a place — the strongest claim available).

The two tests that matter

Evidential strength: could this record convince an auditor or a court? Multi-signal checks that are signed and timestamped pass; a spreadsheet column doesn't. Consent: was the person aware of the check? Verification done covertly fails GDPR-style proportionality tests and destroys employee trust — which is why Njokey checks only at work moments, visibly.

04Primer · 4 min read

GDPR and remote workers

Location is personal data, and employee location is sensitive in practice: the power imbalance of employment makes regulators sceptical of 'consent' and hostile to continuous tracking. That doesn't make verification illegal — it makes proportionality the design requirement.

How Njokey is built privacy-first

What regulators object to

Continuous background tracking, collection invisible to the employee, data kept longer than needed, and monitoring justified by vague 'security' claims. European labour authorities have repeatedly fined employers for exactly these patterns.

What a compliant design looks like

A named lawful basis (usually legitimate interest, documented in a balancing test), data minimisation (verify at work moments, not continuously; store the verdict, not a movement trail), transparency (employees see every check made about them), and retention limits. These are design choices — Njokey makes all four its defaults.

The two-sided obligation

GDPR also cuts the other way: if regulated data may only be accessed from permitted countries, you need location assurance to comply with data-sovereignty duties. Done proportionately, verification is part of GDPR compliance, not a threat to it.

05Primer · 3 min read

Cross-border payroll compliance

Payroll assumes a jurisdiction: tax tables, social contributions, benefits and insurance are all priced to a place. When the place silently changes, every downstream calculation is quietly wrong — and the employer usually carries the liability.

Payroll accuracy as a solution

How drift happens

An employee relocates 'temporarily', a workation stretches, a hire never actually moves to the contracted country. Only a quarter of companies report having a formalized global payroll strategy, so most discover drift through an audit, a benefits claim from the wrong country, or an employee's own tax filing.

Verified jurisdiction as the fix

The remedy isn't more forms — it's wiring payroll to verified location data. A per-jurisdiction day count that payroll can trust turns 'where do we withhold?' from an annual archaeology project into a query.

06Primer · 5 min read

How to build a remote work location policy

A good policy answers four questions in writing: where may people work, for how long, who approves exceptions, and how the company will know. Most policies stop after question two — which is why most policies are fiction.

Walk through your policy with us

Define the map

List approved countries (and, where relevant, regions/states) per role or data class. Export-controlled and regulated roles get shorter lists. Be explicit about home country versus travel: 'anywhere in the EU up to 30 days' is a policy; 'remote-friendly' is a vibe.

Set the clocks and the exceptions path

Cap days per foreign jurisdiction well below the local thresholds (leave a safety margin), define a lightweight approval flow for workations, and say what happens when a cap is near: alert, conversation, plan — not ambush.

Close the loop with verification

State how compliance is checked (verification at work moments, with consent and a visible log), what evidence is kept and for how long, and who sees alerts. A policy without a verification loop is a memo; with one, it's a control that auditors, insurers and regulators actually credit.

Apply it
The problems these concepts create — and how Njokey retires them.
Early access

Read enough. See it running.

Book a walkthrough with your own policies applied to sample workforce data.