Hello,
Your provider can access files, because they have full permission in server.
It's always better to use windows vps, or dedicated server if you want better security.
And windows vps can be hacked too, thus use secure password, change rdp port, enable brute force protection etc.