Assuming the platform knows the user's details, this is almost certainly not possible without massively inconveniencing your users.
The easiest solution would be to just not store any user details. If the user can't place an order without entering their payment card, shipping address, and so on, then anybody can be reasonably sure that, if you have those details, the user was placing an order. However, that doesn't cover things like "what was ordered in what quantity" or prevent a malicious server from logging those details after all and using them to place another order later.
For non-repudation protection like that, you typically need some sort of attestation (on every client action) that only the client can provide. A simple example would be a digital signature (of the order details) using a private key that the client has but the server does not; the signature could be verified by anybody with the public key but couldn't be faked. This is basically the digital equivalent of requiring a customer to sign a receipt or enter their PIN, proving that they approved the transaction.
However, any kind of cryptographic scheme runs into key management problems (where does the client store the private key? Does it move between client systems following the user, and if so how? Remember that the server needs to never be allowed to use it). Additionally, for a web site, the signing would have to be done in JS, which means the server could just serve modified JS that takes the user's key and signs the order anyhow. You could tell the user that their order won't be accepted unless they use an external openpgp app to sign it (
echo "I am purchasing 43 widgets" | gpg -sa) and copy-paste the signature, but it's a rare set of users who'd stand for that.
On the server side, there's no "traces" you could find that couldn't have been planted. Logs, file or database accesses, tickets in an ordering system... you control all of it, so you can fake whatever you want so long as it doesn't require knowing something that the client knows and you don't (like a private key).
The entire connection to the client is encrypted (at least, it had better be!) so even if there's a trusted third party (such as an ISP) between you and the client, they wouldn't be able to tell what was said. They could tell if there'd been no communication at all... along a particular path.
Client-side, the client could plant (or delete) any trace you might look for, and that's assuming there's anything to trace in the first place. Browser history might say what pages the user viewed, but the browser doesn't store the details of what requests it sent (unless you sit there with the dev tools open and recording) and order pages are usually dynamic anyhow. Besides, your site could contain script that quickly navigates through those pages, and then they'd be in the user's history even though no order was actually placed.