I have bought a VPS hosted in the USA through an Iranian company (I live there, it's quite hard to buy one directly.), and I am wondering if it is possible to secure the system against potential spying by the Iranian authorities. Partial, probabilistic solutions are also welcome.
No, physical access trumps whatever security you can apply. I would also expect that the company In the US would comply with Iranian laws, which would most likely demand access.
Techically no, it's not possible to prevent service provider to access all data of a VPS. They have physical access to the server. Even if you encrypt all data on the drive, the service provider has access to the key while it's in the memory. You wouldn't even notice such activity as they can take s snapshot and investigate it instead of the running copy.
Legally, yes. It's probably already illegal to spy on you. But if your opponent is an intelligence agancy of a country, that doesn't weight much.
Only buy a VPS or (dedicated server) from a provider you can trust or host the server yourself.