CFH Docmail

Other United Kingdom Website Reviewed Sept. 22, 2026

UK hybrid mail and multichannel communications provider offering print, post and digital delivery, including electoral and secure financial print.

Report an issue with this profile

Certifications & Accreditations

Certification Certifying Body Scope Achieved Expiry Status
ISO/IEC 27001:2013 NQA (Livingston site); BSI auditors named for Radstock and Windsor CFH Docmail Ltd. Stated as the 2013 revision — likely out of date on the site; confirm the current revision. — — Current
ISO 9001:2015 NQA (Livingston); BSI auditors (Radstock, Windsor); UKAS-accredited CFH Docmail Ltd. No certificate number or dates published. — — Current
ISO 14001:2015 NQA (Livingston); BSI auditors (Radstock, Windsor) CFH Docmail Ltd. No certificate number or dates published. — — Current
Cyber Essentials Plus Not stated by vendor Stated on the certifications page and in the G-Cloud 14 service definition; no certificate number or expiry published. — — Current
Standard 55 (Cheque Printer Accreditation Scheme) Cheque and Credit Clearing Company Accredited cheque printer — CFH’s secure-print accreditation. — — Current
NHS Data Security and Protection Toolkit NHS England Stated as "Standard Exceeded" for 10+ years; no submission reference published. — — Current
FSC Chain of Custody Forest Stewardship Council Licence code FSC C006025. — — Current
PEFC Chain of Custody PEFC Licence PEFC/16-33-528. — — Current

Compliance Frameworks

ISO/IEC 27001:2022
Partial
Stated as ISO/IEC 27001:2013 — a withdrawn revision. Confirm whether CFH has transitioned to the 2022 standard.
ISO 9001:2015
Partial
UKAS-accredited via NQA and BSI depending on site; no certificate numbers or dates published.
ISO 14001:2015
Partial
Same pattern; no certificate numbers or dates.
Cyber Essentials
Partial
Cyber Essentials Plus stated on the certifications page and G-Cloud filing.
GDPR 2016/679
Full
Named DPO (Emma Oatley); ICO registration Z5722574 (expires 17 Jun 2027). No public DPA; G-Cloud documentation references GDPR/DPA 2018 compliance.

Postal partnerships are not accreditations

**No formal Royal Mail accreditation found.** CFH operates as a Downstream Access postal provider and has commercial partnerships with Royal Mail (including a Royal Mail SME direct-mail solution and a Scottish hybrid-communications partnership) — those are **partnerships, not accreditations**. No Mailmark accreditation evidence found.

**Check the ISO 27001 revision**: the site states 2013, which is withdrawn.

No PCI DSS, SOC 2 or HSCN accreditation found. No security contact, disclosure page, security.txt or bug bounty found. The canonical privacy policy URL could not be located at a stable path — confirm before citing. CFH Docmail Ltd, company 01716891, Radstock, Bath.

Assess CFH Docmail in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register