Given Tornado's single threaded design, a production service should run multiple instances of Tornado behind a proxy.<p>Upstart does not help with the multiple instance problem. Upstart adds the problem of running code with elevated privilege.<p>I think it might be simpler to write a script to start/stop/restart daemon Tornado instances running in an unprivileged account.
I liked the "drop privileges in Python for Tornado apps" article more. But even then, you would want to chroot/jail the user for more control over permissions.