SpyShelter Firewall is a program developed in Poland, whose main opinion is to protect the user against threats such as all kinds of reading programs, loggers such as keys pressed on the keyboard, system clipboard content, or the current screen content. The most extensive edition of the Firewall also includes the ability to manage network traffic. The application provides protection against keyloggers, screenloggers, reading the contents of the system clipboard, as well as unauthorized use of the built-in webcam or microphone.

SpyShelter also has an encryption mode for typing data on the keyboard to increase protection. The program is based on white and black lists, by default it allows trusted applications signed digitally. One of the most important functions is the limited application mode, in which selected programs can only write to user-defined locations, without access to others.

A very interesting option is the system protection module and the system kernel. Thanks to it, SpyShelter is able to behave in part like a traditional HIPS, i.e. to monitor the behavior of other applications affecting the operation of the system, registry and controllers.

Thanks to this, it is able to protect not only against loggers, but also against many other types of malware depending on their behavior and attack methods used. In total, SpyShelter monitors nearly 60 different actions. The Firewall edition is enriched with a firewall module, implemented through a TDI or WFP driver (newer Windows systems).

The firewall is based on rules created at the moment of initiating traffic and displaying an appropriate alert, in which the user decides for himself about the action. In addition, it is possible to define network zones based on the network adapters used in the computer.