As for updating packages in Ubuntu, my experience is that it's not that hard. Just prepare a new package, and send the link to the Ubuntu security team, and basically, they can take care of the rest.
When someone maintains a package in Debian, he may care about it, and provide sound security updates once the stable release is out. Though what's unexpected, is that the same package, while well maintained in Debian, may not be fixed in Ubuntu, because you know... it's "Universe"... The security team from Canonical will not take the time to get the updated package from Debian, unless someone carefully prepares the update and do the work for them.
The final result is that the Ubuntu universe repository is full of security issues unless someone "from the community" (understand: the Debian package maintainer) cares doing it, which often doesn't happen.
Don't use Ubuntu on your servers, it's simply not safe.
I think it's more than time that everyone understand Ubuntu is not a good fit for running a server, unless you remove nearly all software from it (that is: everything that is "synced from Debian"). So then, why not using Debian in the first place?
There's also Penta, but it's quite old, and maybe summit is better.
So, if that non-profit thinks SaaS solutions aren't good, tell them they are right. But also tell them that starting from scratch is silly (to say it nicely) when there's already nice free software they can contribute to (for these features that they think nobody has...).
In the debian-cloud list, we had a long discussion about wordings, which I also think is very important. It stroke me that you felt cloud was in essence non-free, and that you wanted everyone to stop using the word "cloud" which you (rightly) thought was too vague. But since there is also private IaaS (Infrastructure as a Service), I do think we may have fully free cloud systems.
I never knew if I was able to convince you that a completely free IaaS software was very important to keep our freedom, and would like to know what is your current feeling about it.
And I will upload it to Sid soon.
And by the way, there has never been a declaration that Debian will support *only one* init system. Just that systemd will be the default for Jessie. Nothing more, nothing less. Anyone willing to help the Debian OpenRC team is welcome to do so (by developing OpenRC, testing it in Debian, writing runscripts, etc.).