An adaptive platform study evaluates multiple intervention arms against a shared control, with arms entering or leaving the study according to pre-specified rules. Instead of running one two-arm trial after another, a platform keeps a single protocol and control group running while candidate interventions rotate through it — a design used when you expect to test several treatments over time and want each to be compared against the same concurrent control.
TrialPilot supports this design end to end: you configure the platform in the Study Builder before the study goes live, and once it is running you operate it from a dedicated runtime workspace with a blinding firewall between operational staff and the unblinded decision-makers.
Enable platform mode#
Turn on Adaptive platform study in the Study Builder when the protocol fits this design. Enabling it reveals the Platform tab, where you configure:
- Platform arms and their coded labels — the neutral labels blinded staff see in place of intervention names.
- Interventions and per-arm allocation weights.
- Control-arm status — which arm serves as the shared control.
- Domain assignments for combination designs.
- Error-control policy — how the design controls statistical error across the multiple comparisons a platform makes.
- Whether the platform is intended for an FDA submission.
- Response-adaptive randomization guardrails — limits on how far allocation can shift toward better-performing arms.
- Combination-design settings.
Platform mode locks at go-live
The platform runtime workspace#
Once the study is live, open Platform from the study navigation. Each tab is scoped to a role in the platform's governance, so people only see the tabs their role allows.
| Tab | Who uses it | What it does |
|---|---|---|
| Manage | Platform managers | Add arms, register and lock decision rules, and schedule interim looks. |
| DSMB / SAC console | SAC and DSMB | Take each interim data cut, export it for analysis, and record the decision that comes back. |
| DSMB reports | SAC, DSMB, platform managers | The frozen report package for each look. The open report is pooled. The closed report is by arm and stays with the SAC and DSMB. |
| Models & simulation | Platform managers, SAC, DSMB | Register in-silico models, record their predictions, and govern how far each may be used. |
| Safety | Platform managers, SAC, DSMB | Adverse events pooled for the blinded team, and by arm against concurrent controls for unblinded roles. |
| Sponsors | Platform managers | Attach the separate company that sponsors an arm, and release its data package once the arm leaves. |
| Costs | Platform managers, SAC, DSMB | Record what the platform spends. Unblinded roles also see cost per arm. |
| Arm status (blinded) | Everyone on the study | Operational arm status under coded labels, without unblinding. |
| Audit | SAC and DSMB | The record of every platform action. |
The split matters because a platform study runs with a blinding firewall. The people who see unblinded interim results are kept apart from the people running the study day to day. Who sees which tab is governed by study-team roles. See Roles and permissions.
How arm decisions are governed#
TrialPilot does not decide when an arm should open, graduate, or stop. The platform executes decisions that have already been made by the DSMB under rules that were locked before the look. When a decision arrives, the platform:
- Validates it against the locked rule for the look. A decision that departs from the rule is allowed, because the DSMB is the authority, but it is recorded as a deviation with a reason.
- Binds it to the frozen data cut it was made on.
- Rolls it out atomically. Arm states and the new allocation table change together, never partly.
Frozen interim cuts#
Taking an interim look freezes the comparative dataset at that moment and hashes it. Every later export of the look returns the same bytes, so anyone can check that the analysis, the DSMB report and the decision all used the same data. If a value is corrected after the cut, the integrity check reports how many records have changed since. The cut itself never moves.
The SAC and the DSMB#
Two unblinded roles have separate jobs. The statistical analysis center (SAC) prepares the analysis. The DSMB reviews it and recommends. The people who prepare the analysis never vote on it, and the board never shapes its own report.
- The SAC builds a report package from a look's frozen cut. It holds an open report with pooled figures only: accrual, outcome completeness, pooled safety and arm status, with no arm marked as the control. It also holds a closed report that sets each arm beside its concurrent controls, with the by-arm safety tables. Both are frozen and hashed when built.
- The SAC checks the package and releases it. The DSMB sees nothing before release.
- The DSMB reads the closed report and records one recommendation with its rationale. The blinded team sees the recommendation and the open report, never the rationale. Every read of a closed report is recorded.
Adding arms#
Arms can join a running platform without stopping enrollment. When the study is under IRB oversight, a new arm starts as Planned. TrialPilot generates the arm's appendix to the master protocol and drafts the IRB amendment that carries it. The arm opens only after the amendment is approved and someone activates it. An AI assistant can draft the appendix, but nothing it writes is used until a person approves it, and its prompt, output and the approval are kept.
Arm stages and sentinel cohorts#
A first-in-human arm can start in a sentinel or dose-finding stage. It takes one small cohort, then receives nobody else until the safety observation window passes and the DSMB releases the next cohort. Moving an arm to the randomized or confirmatory stage is a recorded DSMB decision.
Pre-specified adaptations#
Beyond opening and closing arms, a decision can carry two adaptations. Each needs a locked rule that states its limits in advance.
| Adaptation | What the rule states | What the platform enforces |
|---|---|---|
| Sample-size re-estimation | The minimum and maximum participants per arm, and optionally how far a size may grow in one step. | A new planned size must fit those bounds and can never drop below the participants already randomized. An arm that reaches its planned size receives nobody else. |
| Enrichment | A stratification factor and the levels enrollment may be narrowed to. | Once in force, randomization refuses anyone outside the kept levels and says why. Participants already randomized are unaffected. |
Planned sizes are shown only to unblinded roles, because a re-estimated size can hint at the interim result. The enrichment in force is shown to everyone, because sites need to know who may still enroll.
In-silico models#
A platform can register prognostic or simulation models with a stated intended use and decision role. Each model moves from exploratory to formal use only on recorded validation evidence. Predictions are carried into each frozen cut and marked by whether they were made before the participant was randomized, so only valid baseline predictions are used as covariates.
Safety across arms#
Adverse events are linked to arms through each participant's study-scoped pseudonym, so no identity crosses into the platform. The blinded team sees events pooled across arms. Unblinded roles see each arm against its concurrent controls, with signals when a term clusters in one arm or appears above control levels in several.
Arm sponsors#
Each arm can be sponsored by a separate company, under its own organization. A sponsor sees only its own arms: status, stage, its appendix and amendment status, and serious events for its safety reporting. It never sees accrual or outcomes while the arm runs. When the arm leaves the platform, the unblinded team releases a frozen data package with the arm and its concurrent controls only. References are re-keyed for each sponsor, so two sponsors sharing control participants cannot link their packages.
Supply and cost per arm#
Unblinded staff map treatment kits to arms. Cohort dispatch then sends each randomized participant a kit for their own arm, earliest expiry first. Blinded staff only ever see kit codes, and a treatment kit cannot be shipped by hand, because picking one would reveal the allocation.
The cost ledger records what the platform spends, against one arm or as shared. It only grows. A correction is a new entry with a negative amount. Shared costs are split across arms by participant share, with each control participant shared among the arms open when they were randomized. Cost per arm is shown to unblinded roles only, because the split follows relative accrual.
Related#
Platform mode is one of two randomization paths in TrialPilot. For ordinary randomized controlled, crossover, or factorial designs — with blocked or minimization-based allocation and emergency unblinding — see Randomization and blinding. For how blinded and unblinded roles are assigned across the study team, see Roles and permissions.