These are all valid questions. I worked in both scenarios: working inside an org using NC and offering services to an external one. My take on this: unless you

These are all valid questions. I worked in both scenarios: working inside an org using NC and offering services to an external one. My take on this: unless you don't value your data, you need to have someone that has formal responsibility for this. It is not that much work, actually. And for someone who takes care of many NC servers, most of the work can be automated. Regular upgrades are necessary, and these require a full backup. Given the nature of the software, I don't believe this can be done without access to the data itself, so it has to be a company or employees you trust. And of course you must not install any additional apps.