Windows 10 and previous versions are known to be SIGINT enabled either by design, or by accident. It would be very cloak and dagger to say by design, but certainly more plausible to say by accident. There are numerous ways to harden Windows however, and depending on how much time and money you're willing to invest; you can get a pretty robust setup. Personally I use Zemana Antilogger (try to get an older copy - the new one is possibly backdoored). Download this: http://hardenwindows8forsecurity.com/ (Some of the settings still apply on Win10 I think). And buy the new version of Glasswire: https://www.glasswire.com/ (Super handy utility that stops all the phone behavior of Win10 that can get quite intrusive/invasive). There are many other hacks to harden Windows but I won't go into them here. But you can have those ones for free...

Here's Antilogger: https://www.zemana.com/AntiLoggerFree Please avoid the new version, as it's probably weakened by ICs. I'm sure an older copy is lying around the net somewhere.