Connect
One credential in your pharmacy management system directs its event feed to the platform over HTTPS. No workstation agent, no scraping, no workflow change for your team.
Architecture
It reads your system of record. It does not replace it.
Your pharmacy management system owns the dispensing workflow and keeps it. Attergo subscribes to the events it already publishes and adds the economics, the billing and the evidence on top. Nothing about how your staff fills a prescription changes.
The data flow
From connection to action in four stages.
Capture
Payloads land in an append-only archive first, then a worker projects them into the canonical event model. The archive is the record of truth; every projection can be rebuilt from it.
Compute
Margin against wholesaler invoices. Documentation completeness. Billable encounters. Authorization triggers. Rules evaluate in seconds, on every event, continuously.
Act
Exceptions arrive as work items with one owner and one action. Hold the fill, submit the claim, attach the record, file the appeal. The decision happens while it still changes the outcome.
Engineering decisions
The architecture is the guarantee.
Each decision below is the reason a specific promise elsewhere on this site holds. All of them are verifiable in diligence, and we invite exactly that.
Archive before interpretation
Every event is stored exactly as received, byte for byte, before a single field is read. Normalization is a separate, re-runnable projection over that archive. When rules improve, history is re-derived; when an auditor asks, the answer is the original record, not an interpretation of it.
Unknown fields never fail ingestion
A field the platform has not mapped is recorded for review, not rejected. A source system changing its payload cannot interrupt your data flow, because silent data loss is a worse failure than a mapping backlog.
Idempotent delivery
Each event carries a deterministic key derived from its content and origin. Duplicates are recognized and discarded, retries cost nothing, replays are safe, and an unstable connection cannot corrupt a single number.
Money is an integer, always
Every amount is stored and computed in minor units. Floating point never touches money anywhere in the platform, because binary floats cannot represent most decimal amounts exactly and the error compounds across millions of fills.
Isolation lives in the database
Separation between organizations is enforced by row-level security at the data layer, not by application code remembering a filter. An unscoped query returns nothing. The database fails closed.
Vendor specifics stay behind one interface
Everything particular to a source system is isolated in its adapter. No product reasons about a vendor quirk. Supporting the next system is a new adapter, never a change to how margin is computed.
Isolation, concretely
Three database roles, and the application never holds the powerful one.
Tenant separation that lives in application code is one forgotten WHERE clause away from a breach, and no amount of review reliably catches the one that was forgotten. So it lives underneath the application, where the application cannot reach it.
| Role | Used by | What it can do |
|---|---|---|
| Owner | Migrations only, never the running service | Change schema. Holds no runtime credential anywhere in the deployed system. |
| Application | Every API request and every worker job | Read and write tenant data, subject to row-level security that is enabled and forced. It cannot disable the policy, and it holds no UPDATE or DELETE on the raw archive. |
| Resolver | Narrow lookups that must cross a tenant boundary | Read a small set of explicitly granted columns. Asking it for a monetary column is a permission error, not a policy violation somebody has to notice. |
The tenant is set as a transaction-scoped database parameter on every request. An unscoped query returns nothing. The database fails closed.
Who it serves
Pharmacy first. The architecture serves every provider type.
Attergo deploys first in independent pharmacy, where the revenue integrity problem is sharpest. Nothing in the data model, the routes or the business logic assumes pharmacy is the only organization type: clinics, health centers, specialty and long-term-care pharmacies, infusion and physician practices run on the same platform, the same event spine and the same evidence architecture.
Evaluate it properly.
Bring your IT partner. We will walk the architecture, the isolation model and the evidence chain, on a live system.