What we mean by zero logging

Lorem ipsum dolor sit amet consectetur. "We do not log" is a sentence about intent. It is also the single most common sentence in this industry, and intent is not something a reader can check.

The difference that matters

Nullam sed tellus pharetra egestas vitae consectetur. The version worth writing down is structural: the resolver holds no query records because the code path that would write one does not exist, and the tunnel holds no flow records because the identity it would key them against is a certificate rather than an account.

Sed do eiusmod tempor incididunt ut labore et dolore. Which means the answer to a subpoena is a description of a code path, and the answer to "can you make an exception" is no rather than a negotiation. The DNS root piece covers the resolver half of that in more detail.