diff --git a/facilities.c b/facilities.c
index dda9d1c..1d9e680 100644
--- a/facilities.c
+++ b/facilities.c
@@ -55,6 +55,7 @@ typedef enum
     facility_cloak_hex_ident,
     facility_cloak_ident,
     facility_cloak_account,
+    facility_cloak_irccloud,
 } facility_cloak_type;
 
 static struct {
@@ -67,6 +68,7 @@ static struct {
     { "hexip",     facility_cloak_hex_ident },
     { "ident",     facility_cloak_ident     },
     { "account",   facility_cloak_account   },
+    { "irccloud",  facility_cloak_irccloud  },
     { NULL, 0 }
 };
 
@@ -532,6 +534,47 @@ void facility_newuser(hook_user_nick_t *data)
                 facility_set_cloak(u, new_vhost, cloak_override);
                 break;
             }
+        case facility_cloak_irccloud:
+            {
+                char *idstart = strstr(new_vhost, "session");
+                if (idstart == NULL)
+                {
+                    syn_debug(2, "IRCCloud cloaking used for %s, but I couldn't find a session marker in %s", u->nick, new_vhost);
+                    break;
+                }
+
+                const char *ident = u->user;
+                if (*ident == '~')
+                    ++ident;
+
+                if (strncmp(ident, "uid", 3) && strncmp(ident, "sid", 3))
+                    goto irccloud_error;
+
+                // Skip u/s
+                ident++;
+
+                // make sure we actually have an ID after the "id"
+                if (!ident[2])
+                    goto irccloud_error;
+
+                // skip "id", then check it's digits only
+                for (const char *c = ident + 2; *c; c++)
+                {
+                    if (!isdigit(*c))
+                        goto irccloud_error;
+                }
+
+                strncpy(idstart, ident, new_vhost + HOSTLEN - idstart);
+                facility_set_cloak(u, new_vhost, cloak_override);
+                break;
+
+irccloud_error:
+                syn_report("Killing user %s; facility %s requires irccloud ident but ident doesn't match",
+                        u->nick, cloaking_facility->hostpart);
+                syn_kill2(u, "No user ID supplied", "Your gateway requires a user ID to be supplied, which could not be found.");
+                data->u = NULL;
+                return;
+            }
         case facility_cloak_random:
             {
                 char *randstart = strstr(new_vhost, "session");
@@ -615,6 +658,8 @@ static void syn_facility_help(sourceinfo_t *si, const char *subcmd)
         command_success_nodata(si, "   way, it falls back to the random method.");
         command_success_nodata(si, " - ident. The user's ident is placed in their host directly");
         command_success_nodata(si, "   (with special characters removed appropriately).");
+        command_success_nodata(si, " - irccloud. The user's IRCCloud ID is placed in their host");
+        command_success_nodata(si, "   after removing the initial u/s.");
         command_success_nodata(si, " - account. This is meant to be used with a sasl_usercloak");
         command_success_nodata(si, "   auth {} block and applies the host generated by the ircd");
         command_success_nodata(si, "   as gateway cloak, overriding unaffiliated cloaks.");