Three Roses Property Management
A rental site for homes in Memphis, Detroit and Alabama, with a secure online tenant application that produces a signed PDF and stores documents privately.
- Client
- Three Roses Property Management
- Location
- Memphis, TN · Detroit, MI · Birmingham and Pinson, AL
- What we built
- Rental listings · secure online application
- Stack
- Astro · Vercel · Cloudflare R2 · Resend
- Live site
- threerosespm.com (opens in a new tab)
At a glance
Three Roses rents Section 8 and affordable homes in Memphis, Detroit and Alabama. It needed a page for every rental, and an application renters could finish on a phone without anyone retyping it at the other end.
A rental application is some of the most sensitive paperwork a person fills in: identity, income, rental history, references. So half the job was the form, and the other half was where that information goes and who can see it.
- 10 rental listings Memphis · Detroit · Birmingham · Pinson
- 9 application steps signed and delivered as a PDF
- 25 × 30 MB supporting documents PDFs and phone photos, stored privately
- 7 days document links signed, then expired
Source: the live site, its property catalog and its application, September 2026.
Before and after
The home page before we started, and today. Drag the line, or focus it and use the arrow keys.
Before: the owner’s previous rental site, ghmrental.com, under the Gordillo Holdings Management name, rebuilt from a copy we saved in July 2026. After: the new Three Roses site.
Every home, honestly listed
All the rentals live in one catalog, and every listing page is generated from it, so adding a property means adding a record, not designing a page. The rentals page filters by Tennessee, Michigan, Alabama or Available only, with a live count of what’s showing.
The catalog says so when something isn’t known yet. Pending details read Details coming soon, prices appear only where they’ve been confirmed, and a rented home keeps its page but drops out of the application and loses its apply button. Each residence page carries structured data for search engines and, on a phone, a slim apply bar that follows the reader down the page.
Nine steps, one screen at a time
The application asks for everything screening needs, in nine short steps, each checked before you move on so problems surface one screen at a time. Inputs are at least 48px tall, Next sits under the thumb, and every field carries the keyboard and autocomplete hints that let a phone fill in names and addresses. With JavaScript off, the whole form still renders on one page and still submits.
Five of the nine steps, from the live form, shown empty:
Signed, delivered, kept private
On submit, the server builds a signed PDF of the whole application: every answer, the certification text, the signature and a signature record. It goes to the managers who cover the property’s state, with a copy to the applicant, and the submission is added to a private log only authorized staff can open.
Documents go straight from the phone to private storage, including the HEIC photos iPhones take by default. The server reads the first bytes of every file to confirm it really is a PDF or an image, and staff get signed links that expire after seven days. Uploads were tested on real iPhones and Android phones, and production downloads were checked byte for byte.
- Bot protection. An invisible Cloudflare Turnstile challenge, a honeypot field and a minimum time on the form, with no puzzle for real people.
- Sensitive details out of sight. The most sensitive screening details never appear in an email subject, preview, URL or log.
- No secrets in the browser. Storage and email credentials live only on the server, and emailed links point at the Three Roses site, never the storage bucket.
For engineersThe signature record, the PDF and state routing
The certification text lives in one constant that both the page and the server read. The browser sends a hash of the text it showed; the server recomputes the hash from its own copy and compares, so the signed words and the recorded words can’t drift apart. The signing time comes from the server clock, never the form.
The PDF is drawn with pdf-lib in a module with no framework or email
imports, so it can be tested on its own. Routing keys off each property’s
state field, so a new listing in a covered state routes correctly the
moment it’s added, and a state with no managers assigned goes to everyone rather than
no one. The applications log is appended through short-lived federated credentials,
so no long-lived key is stored anywhere.
The result
Three Roses is live at threerosespm.com on Astro and Vercel: ten rentals and a home for sale, each on its own page, and an application a renter can finish on a phone. Every submission arrives as a signed PDF with its documents one private link away, and Google Analytics counts applications, calls, emails and requests for directions.
A rental site that shows every home honestly, and an application that gets signed paperwork to the right people without exposing anyone’s details on the way.