How exactly would an entity that makes such a claim, as in this case of "we don't log access", be able to allow external parties to verify this without handing over access to their infrastructure for manual inspection?

I've read a little about zero knowledge proofs, but don't really know much about the subject to know if it could be used to verify these sorts of claims.